Critical Vulnerability in Alby Hub Software
Bitcoin wallet provider Alby issued a warning regarding a security flaw in its self-hosted Alby Hub software. This vulnerability allows an unauthorized actor to gain control of a wallet and transfer funds. The risk specifically targets installations where the Hub management interface remains reachable from the public internet. Alby confirmed that at least one user experienced an incident related to this security gap.
The flaw affects all software versions from v1.7.0 through v1.18.5. Users running these builds on servers exposed to the web are at high risk. The company addressed the issue in v1.19.0, which was released on August 29, 2025. Every version prior to that date contains the vulnerability. Alby urges all users to update their software immediately, as the current version is v1.24.0.
Immediate Steps for Users
Security remains the primary concern for self-hosted wallet owners. If you operate an Alby Hub, start by checking your current version number. If it falls within the affected range, you must restrict network access immediately. For Docker users, this involves changing the configuration to bind the port to 127.0.0.1 rather than allowing external connections. On cloud servers, firewall rules should be updated to block public traffic from any IP except your own.
After securing the network perimeter, update the software to v1.24.0 without delay. Alby also recommends that any user who had an exposed Hub running an affected version should change their unlock password as a precaution. The company has not provided a full technical breakdown of the exploit, citing a commitment to responsible disclosure practices while they wait to release more information.
Addressing Past Configuration Errors
Questions persist regarding how many users inadvertently placed their wallets on the public web. Alby documentation historically contained guidance that led users to expose their management interfaces. Recent changes merged on September 7, 2026, finally corrected these setup guides. The new documentation explicitly warns owners against putting the Hub on the public internet, noting that the server previously listened on all network interfaces by default.
Previous versions of the setup guides for services like DigitalOcean and Hetzner encouraged configurations that left the port 8080 management interface open. Alby confirmed that a different incident occurred in November 2025 where a user lost funds because their Hub was reachable via the clearnet. While that case involved an uninitialized wallet, it underscores the danger of public exposure. The company continues to work with researchers to identify and patch additional issues. Users should watch for future updates and maintain strict firewall policies for all self-hosted infrastructure.