Bitcoin wallet provider Alby has identified a significant vulnerability within its Alby Hub software, potentially allowing attackers to seize control of wallets. This critical flaw, affecting versions from v1.7.0 to v1.18.5, poses a risk when the hub is accessible over the internet.
Understanding the Alby Hub Vulnerability
Alby Hub operates as a self-hosted Lightning wallet, managed by users on personal computers or servers. The flaw was discovered in versions released before August 2025, with one user reportedly impacted. Fortunately, subsequent releases from v1.19.0 onward, including the current v1.24.0, have resolved this issue.
Alby advises users operating older versions to restrict external access to the wallet’s management page immediately. This precaution aims to prevent unauthorized control and suggests updating to the latest version.
Steps to Safeguard Your Bitcoin Wallet
For users still on outdated versions, a critical first step is to disable internet access to the hub’s interface. This can be accomplished by adjusting port settings in Docker setups or modifying firewall rules on cloud servers. Following these actions, upgrading to version v1.24.0 is essential.
Additionally, Alby recommends changing the wallet’s unlock password if the hub was previously exposed online. This measure targets potential security breaches, although specific details about the flaw remain undisclosed.
Background on Internet Exposure Risks
The Alby Hub is designed to function within private networks, necessitating a login for web access. Recent documentation updates emphasize the importance of not exposing the hub to public networks. Changes to setup guides and Docker files reinforce this by limiting the hub’s network exposure.
Historically, Alby has faced similar issues, including an incident in November 2025 where an unsecured hub was exploited. In response, updates were made to enhance security, such as integrating the hub into Umbrel’s login system.
Conclusion and Future Implications
The discovery of this vulnerability underscores the importance of maintaining up-to-date software and implementing robust security measures. Alby’s continued diligence in addressing these challenges highlights its commitment to user safety. Users are encouraged to follow the latest guidelines and ensure their systems are secure against potential threats.
