Critical Flaw in Alby Hub Exposes Self‑Hosted Lightning Wallets to Takeover

Alby, a provider of self‑hosted Lightning Network wallets, disclosed a severe vulnerability in its Alby Hub software that could have allowed an attacker to seize control of a wallet and transfer its Bitcoin holdings.

The issue was limited to installations where the Hub had been exposed to the public internet, a configuration some users adopt for remote access. In that scenario, a malicious actor could exploit the flaw to commandeer the wallet’s private keys and initiate unauthorized transactions.

Alby Hub is designed to run on a user’s own server, giving the owner full custody of Lightning funds without relying on a third‑party custodial service. While this architecture offers strong privacy benefits, it also places the burden of security on the operator, making proper network hardening essential.

According to the company’s advisory, the vulnerability has been patched and users are urged to update to the latest version immediately. Alby also recommends disabling any direct internet exposure of the Hub, employing firewalls or VPNs, and reviewing access logs for any suspicious activity.

Security researchers have highlighted the episode as a reminder that self‑hosted cryptocurrency tools, while empowering, can introduce attack surfaces if not configured correctly. The broader crypto community continues to debate the trade‑offs between decentralised custody and the operational expertise required to keep such systems safe.