Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets
Alby warns a critical flaw in internet-exposed Alby Hub Bitcoin wallets (v1.7.0–v1.18.5) could allow takeover and fund theft; update to v1.24.0.
Alby disclosed a critical flaw in Alby Hub, its self-hosted Lightning wallet, affecting versions v1.7.0 through v1.18.5 when the management interface is reachable from the internet. The flaw could let attackers take over a wallet and send its funds; one affected user has been reported so far, with no word on losses. Versions v1.19.0 and later contain the fix, and Alby advises updating to v1.24.0, binding port 8080 to localhost or firewalled sources, and changing unlock passwords on previously exposed hubs. Full technical details will be published later under responsible disclosure.
- Affected range v1.7.0 to v1.18.5 with internet-exposed management interface
- First fixed release was v1.19.0 (August 2025); current is v1.24.0
- Docker users should publish port 8080 as 127.0.0.1:8080:8080
- November 2025 saw an unfinished, publicly exposed Hub drained by an attacker
- Vendors
- Alby
From the original article
4 min read at thehackernews.com
Bitcoin wallet company Alby has warned of a critical flaw in Alby Hub that could have let an attacker take over a wallet and send its funds, but only where the owner had made the Hub reachable from the internet. Alby Hub is a self-hosted Lightning wallet, meaning the owner runs it on their own computer or server, and it holds their bitcoin. The flaw affects versions v1.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.