Alby Hub Flaw Exposes Bitcoin Wallets to Remote Takeover

Michael Miller · 2026-09-09

Imagine waking up to find your Bitcoin wallet drained. Not because you clicked a phishing link or lost your keys, but because your self-hosted Lightning node was quietly reachable from the internet. That's the reality Alby recently warned about with a critical flaw in Alby Hub. The company disclosed that a vulnerability could have let an attacker take over a wallet and send its funds anywhere they wanted. The catch? It only applied to setups where the owner had exposed the Hub to the internet. ### What Exactly Is Alby Hub? Alby Hub is a self-hosted Lightning wallet. That means you run it on your own computer or server, and you hold your own Bitcoin. No exchange, no third party, just you and your node. It's a setup that appeals to people who value sovereignty over convenience. But self-hosting comes with its own set of responsibilities. One of them is making sure your node isn't wide open to the public internet. The flaw affected versions v1.7.0 through a later patch, according to Alby's advisory. If your Hub was exposed, an attacker could potentially seize control. ### Why Exposure Matters Here's the thing about self-hosted wallets: they're only as safe as the network they're on. If your Hub is reachable from the internet, anyone can knock on the door. Most of the time, that's fine. But when a critical bug exists, that knock can turn into a break-in. > "The flaw could have let an attacker take over a wallet and send its funds, but only where the owner had made the Hub reachable from the internet." That single condition makes all the difference. Users who kept their Hub behind a firewall or on a private network were not at risk. Users who exposed it were. ### What You Should Do Right Now If you run Alby Hub, don't panic. Just act. - Check your version. If you're on v1.7.0 or any version before the patch, update immediately. - Review your network setup. Is your Hub directly accessible from the internet? If so, consider locking it down. - Use a VPN or Tor. Both can hide your node from casual scans and attackers. - Monitor your wallet. Look for any unauthorized transactions, even small ones. ### The Bigger Lesson for Self-Custody This isn't just about Alby. It's a reminder that self-custody means self-responsibility. You get freedom from third parties, but you also become your own security team. A single misconfiguration can undo months of careful key management. That doesn't mean you should abandon self-hosting. It means you should treat every exposed service as a potential target. Keep software updated. Keep services private. And never assume a small project is too obscure to be attacked. Alby responded quickly, and that's a good sign. But the next flaw might not be disclosed so responsibly. Stay sharp, keep your node patched, and don't leave the door open.