Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets
Alby Hub, a self-hosted Bitcoin wallet management interface, has a critical vulnerability (v1.7.0 - v1.18.5) that could allow attackers to take over wallets if the Hub is accessible from the internet. Users running affected versions should immediately stop external access to the Hub's management interface and update to version 1.24.0, while also changing their unlock password to mitigate potential damage. The vulnerability stems from the Hub listening on all network interfaces, not just localhost, and a previous takeover occurred due to an incomplete setup.
A critical vulnerability in Alby Hub, a self-hosted Bitcoin wallet management interface, has been discovered that could allow attackers to take over wallets and steal funds. The flaw, present in versions v1.7.0 through v1.18.5, stems from the Hub’s configuration, which allows it to listen on all network interfaces, rather than just localhost. This means if the Hub is accessible from the internet, an attacker could gain control.
Alby, the company behind Alby Hub, has advised users running affected versions to immediately stop external access to the Hub’s management interface. This involves either disabling port publishing in Docker setups or configuring firewall rules to restrict access to port 8080. Users should then update to version 1.24.0, the current release, which addresses the vulnerability.
Furthermore, Alby recommends that users change their unlock password after updating, as this will help to mitigate any potential damage from an attacker who may have gained access to the Hub. The vulnerability was highlighted after a previous takeover in November 2025, where an attacker emptied a user’s wallet because the Hub was accessible publicly.
Alby explained that this previous incident was due to an incomplete setup – the Hub lacked an unlock password – and not the vulnerability itself. The company’s documentation now explicitly warns against putting the Hub on the public internet, a warning that was previously absent.
Several guides, including those for DigitalOcean and Hetzner, previously recommended allowing public access to the Hub, publishing the port to every address, and using a reverse proxy. These guides have been updated to reflect the current risk and advise against exposing the Hub to the internet. The company’s Umbrel listing installs v1.21.4, which is newer than the fixed version, but this doesn’t necessarily reflect the version running on any given Hub.
Alby has not yet disclosed the specific details of the vulnerability. The Hacker News has reached out to Alby for clarification on the password change and whether Alby Cloud has already addressed the issue for users. The vulnerability’s scope is currently unknown, but it highlights a significant risk for users running older versions of Alby Hub.