Critical Alby Hub Flaw Allows Remote Takeover of Exposed Bitcoin Wallets

Bitcoin Lightning wallet provider Alby has disclosed a critical vulnerability in its self-hosted Alby Hub software that could allow remote attackers to seize control of wallets and drain funds, provided the owner's Hub instance was reachable from the public internet. The flaw affects Alby Hub versions v1.7.0 through v1.18.5, all released prior to August 2025, and Alby confirmed that at least one user has already been impacted. The patched release, v1.19.0, shipped on August 29, 2025, with the current recommended build being v1.24.0. Alby has withheld technical specifics pending a coordinated disclosure window but credited external researchers for additional fixes bundled into the latest version.

The root cause appears tied to a longstanding misconfiguration in the project's setup guides. According to documentation changes merged on September 7, several installation tutorials incorrectly described the Hub server as binding to localhost when it was actually listening on all network interfaces. The same update revised the official Docker image to publish port 8080 only to 127.0.0.1 instead of binding it to every network interface. In practice, this meant operators who followed the older guides may have unknowingly exposed their wallet's web management interface to the internet, where it could be probed using a port scanner and potentially exploited. Alby is urging affected users to immediately restrict external access to port 8080, then update to v1.24.0, and finally rotate their unlock password and contact security@getalby.com.

For operators running an affected version, Alby's guidance leaves some ambiguity: the company has not confirmed whether the update alone terminates any active attacker access to a previously exposed Hub. The recommendation to change the unlock password strongly implies that credentials or session tokens may have been compromised during the exposure window, and operators should also verify the integrity of their wallet's recovery seed. Users who reused the same unlock password elsewhere should test it against known exposures using a password checker and rotate any matching credentials to prevent credential-stuffing follow-on attacks. Alby Hub is designed to operate on a private network behind authentication, and the incident underscores how a single misbound port can turn a self-custody tool into an open vault.

Alby has not disclosed whether the affected user suffered a financial loss, and full technical details of the vulnerability remain unpublished. The case serves as a cautionary example of how self-hosted cryptocurrency infrastructure inherits the security burden of proper network configuration, and how documentation drift between maintainers and deployers can quietly widen the attack surface. Operators should audit their Hub's network exposure today and treat any internet-facing wallet interface as a high-risk asset requiring immediate remediation.