Bitcoin wallet flaw in Alby Hub could have let attackers drain funds
A critical bug in the self-hosted Lightning wallet exposed users who opened their Hub to the internet, though the vendor says there is no sign it was used in the wild.
Key points
- Alby has patched a critical flaw in Alby Hub, a self-hosted Bitcoin Lightning wallet, that could let a remote attacker take over a wallet and send its funds.
- Only users who had made their Hub reachable from the internet were at risk; Hubs running only on a home network were not exposed.
- The bug affects Alby Hub versions v1.7.0 and later, and owners are urged to update immediately.
- Alby says it has no evidence the flaw was exploited before disclosure.
A company that makes Bitcoin wallet software has warned of a serious security hole that could have let strangers on the internet empty a user's wallet.
Alby builds a product called Alby Hub: a self-hosted Lightning wallet, meaning the owner runs the software on their own computer or small server, holding their bitcoin directly with no bank or exchange in the middle. That design gives the owner full control. It also means that when the software has a bug, the owner carries the risk.
What went wrong?
Alby found a critical flaw in Alby Hub that could let an attacker take over the wallet and move the money out, but only if the attacker could reach the Hub over the internet.
Many users run Alby Hub solely on a home network, invisible to the outside world. Those users weren't exposed. The people at risk were those who'd deliberately opened their Hub to the internet, say, to reach it from a phone while travelling. For them, an attacker who found the Hub online could have controlled it as if they were the owner.
The bug affects Alby Hub starting at version v1.7.0. Alby has released a fix and is telling every user to update straight away.
Was anyone actually robbed?
Alby says it has no evidence the flaw was used against real users before the fix went out. The company found the problem, released the patch, then disclosed it, first reported by The Hacker News. That's the safer order of events.
Absence of evidence isn't evidence of absence, though. Anyone who ran an internet-exposed Hub on an affected version should treat their setup as potentially reachable and check recent wallet activity for payments they don't recognise. Lightning payments are fast and, once sent, can't be called back.
What should Alby Hub owners do now?
Update to the latest version today. After updating, ask whether your Hub really needs to be open to the internet. If you only use it from home, close that door. For those who need remote access, put the Hub behind a VPN, a private tunnel only you can enter, rather than leaving it exposed directly.
Why this matters beyond Alby
This story has a recent parallel on our beat. We covered the Liquid Network exploit on 8 September, where a bug in Elements software let someone drain nearly 4,000 bitcoin; most came back, but roughly 598 bitcoin worth about $47 million has not. The mechanism was different, but the lesson is the same: Bitcoin infrastructure bugs carry real, irreversible financial consequences.
Self-hosted wallets are popular because they cut out middlemen and give people direct control of their money. They also shift every security decision onto the owner. A bank would push a fix to its own servers overnight; with a self-hosted wallet, the fix only helps people who install it.
"Self-hosted" and "secure by default" aren't the same thing. Exposing any wallet or admin panel directly to the internet raises the cost of every bug the software might carry, patched or not. The detail worth watching here is how many users on v1.7.0 or later actually had remote access enabled. Alby hasn't published that figure, and until it does, the true exposure is unknown.
