Critical Security Flaw Discovered in Alby Hub: Bitcoin Wallet Users Urged to Update Immediately

Critical Flaw Discovered in Alby Hub Bitcoin Wallet: Users Urged to Update Immediately

By Swati Khandelwal | September 9, 2026

In a significant security alert, Bitcoin wallet company Alby has disclosed a critical vulnerability in its self-hosted Lightning wallet, Alby Hub. This flaw could potentially allow attackers to take control of a wallet and siphon off funds, but only if the wallet owner had made the Hub accessible from the internet.

The vulnerability affects versions v1.7.0 through v1.18.5, all released prior to August 2025. Alby has confirmed that, to date, only one user has reported being impacted by this issue. The company has not disclosed whether this user suffered any financial loss.

Immediate Action Required

Alby is urging users still operating on the affected versions to take immediate action. The first step is to restrict outside access to the Hub’s management interface, which is the web page used to control the wallet. Users are advised to update to version v1.24.0, the latest release that addresses this critical flaw. Versions v1.19.0 and later are not affected.

For those running an older version, Alby recommends the following steps:

1. Check the version of your Hub.
2. If it is v1.18.5 or older, restrict outside access.
3. Update to v1.24.0.
4. If your Hub was reachable from the internet, change your unlock password after the update and contact Alby’s security team.

A Cautionary Tale

This is not the first time Alby Hub users have faced security issues. In November 2025, a user reported that their Hub had been emptied after it was left publicly accessible. Alby attributed that incident to a different problem, where the Hub’s setup was incomplete, allowing an attacker to finish the setup and gain access.

The recent warning has raised questions about the security practices surrounding Alby Hub. The company has acknowledged that its documentation previously misled users into believing the Hub was safe to run on public networks. A recent update to the documentation now explicitly advises against exposing the Hub to the internet.

What’s Next for Alby Users?

As the cryptocurrency landscape continues to evolve, the need for robust security measures becomes increasingly critical. Alby has committed to responsible disclosure practices and plans to release full details about the vulnerability in the near future. Meanwhile, users are left to navigate the complexities of securing their digital assets.

For those who have yet to update, the clock is ticking. With the potential for significant financial loss, users are encouraged to act swiftly to safeguard their investments. The Alby team has expressed gratitude to researchers who reported other issues that have since been resolved in the latest release.

As the situation develops, The Hacker News has reached out to Alby for further clarification on the vulnerability and the implications for users running earlier versions of the Hub. Stay tuned for updates as more information becomes available.