Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets

Summary: Alby warned of a critical flaw in its self-hosted Lightning wallet Alby Hub, affecting versions v1.7.0 through v1.18.5, that could have let an attacker take over a wallet and send its funds where the owner had made the Hub reachable from the internet. Alby said one user has been affected so far, did not say whether that user lost money, and has not disclosed what the flaw is; the fix first shipped on August 29, 2025, and the current release is v1.24.0.
Key Takeaway: Alby's own cloud and Hetzner setup guides still told owners to keep the server's public address on and open port 8080 to any IPv4 and IPv6 address as of September 9, the day of the warning, and a documentation change merged September 7 corrected guides that had described the server as running on localhost when it actually listens on all network interfaces. One user has already been affected, and Alby has not said whether updating alone ends access an attacker already had to an exposed Hub.

Read the original at The Hacker News ↗