Bitcoin wallet provider Alby said a severe vulnerability affected Alby Hub versions v1.7.0 through v1.18.5, covering releases published before August 2025. According to the team, if a Hub instance was reachable from the public internet, an attacker could access the management API, gain unauthorized access, and move funds out of the wallet. Alby said v1.19.0 and later are not affected, noting that v1.19.0 was released on Aug. 29, 2025. The company has confirmed that one user was impacted. For users running affected versions, Alby urged immediate action: restrict public internet access to the management interface and upgrade to the latest release, v1.24.0. It also said that users whose management interface had previously been exposed publicly should change their unlock password after upgrading. Even users on unaffected versions were advised to move to v1.24.0 to receive additional security improvements. Alby added that it plans to publish full details later under a responsible disclosure process.
Bitcoin wallet provider Alby said on X that Alby Hub versions v1.7.0 through v1.18.5 contain a severe vulnerability. The affected releases were published before August 2025.
According to Alby, if a Hub instance's management interface was accessible from the public internet, an attacker could reach the management API, obtain unauthorized access, and transfer funds out. The team said it has confirmed one affected user.
Affected and unaffected versions
Alby said version v1.19.0 and later are not affected. It added that v1.19.0 was released on Aug. 29, 2025.
What Alby advised users to do
Users running affected versions were told to immediately restrict public access to the management interface and upgrade to the latest version, v1.24.0.
For users whose management interface had previously been exposed to the public internet, Alby said they should also update their unlock password after the upgrade.
Users who are not affected were also advised to upgrade to v1.24.0 to receive additional security improvements.
Further disclosure
The team said it will release full details later in line with responsible disclosure practices.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
