Lightning Security Alert: Alby Reveals Critical Hub Vulnerability

Key Takeaways

• Alby says Hub v1.7.0-v1.18.5 had a flaw that only hit 1 known user.
• Lightning Network infrastructure security remains a work in progress. AI-assisted discovery is putting developers on their toes.
• Alby says v1.24.0 puts users back in the driver’s seat with tighter Hub security.

Lightning Project Alby Confirms Critical Flaw in Older Hub Versions

The team disclosed the issue on the social media platform X on Wednesday, stating: “We have confirmed a critical vulnerability in Alby Hub v1.7.0–v1.18.5 (releases prior to August 2025) when the Hub is publicly accessible from the internet.”

This vulnerability, the official Alby X account wrote, could let an attacker who can reach the Hub’s management API get in without permission and send funds.

Alby continued:

“Alby Hub v1.19.0 (released Aug 29, 2025) or newer are unaffected. As with any incident of this kind, we are deeply sorry — above all for the users affected. To our current knowledge, one user has been impacted and thankfully reported these details. We have poured all our energy and resources of the past years into this project, and an issue like this hits us hard.”

For people who may be affected by the bug, Alby says users should check which version they have installed first thing. Then, if a user is on an affected version, they need to make sure to lock down public access to their Hub’s management interface and update right away to v1.24.0, the newest Alby Hub release. Alby also thanked the Bitcoin Red Team developers who “reported several issues, which have been fixed in the latest release.”