Bitcoin Lightning Network wallet and infrastructure provider Alby has confirmed a serious vulnerability in the old version of Alby Hub, where attackers can gain unauthorized access and transfer funds under specific conditions.

The affected range is Alby Hub v1.7.0 to v1.18.5, which includes versions released before August 2025. The prerequisite is that the Hub is accessible from the public network, allowing attackers to reach the management interface. Versions v1.19.0 and later are not affected, with this version released on August 29, 2025.

The company stated that one user is currently known to be affected and has reported details. The official recommendation for affected users is to immediately restrict public access to the management interface and upgrade to the latest version v1.24.0; if previously exposed to the public network, users should also change their unlock password after upgrading. Unaffected users are also advised to upgrade to the same version for additional security fixes.

Complete technical details will be disclosed later according to responsible disclosure principles. The latest version also fixes other issues reported by researchers such as Bitcoin Team Red and Project Loupe, including backup recovery path traversal defects. The official emphasized that the Hub should ideally operate in a private environment such as a home network or VPN, and should not be directly exposed to the public network by default.

Alby Hub is positioned as a self-hosted Lightning node and wallet hub, capable of connecting external applications via the NWC protocol. The product offers both self-deployment and cloud hosting options, and if the management interface listens to all network cards without firewall restrictions, it will expand the attack surface.

From a market mechanism perspective, this is a trust shock driven by a security incident: the security premium of funds in self-hosted Lightning tools is damaged, leading users to temporarily reduce public exposure, migrate to patched versions, or adopt more closed node solutions; security auditing and upgrade services benefit, while nodes still running old versions with open ports are under pressure. The risk to funds is concentrated on the remotely accessible management interface, rather than the daily routing of the Lightning channels themselves.

The company stated that complete details will be released later, with the current disclosure focusing on the version range, conditions for public exposure, and upgrade paths, rather than the total amount of losses.

Source: Public Information