Alby Warns v1.7.0-v1.18.5 Flaw Could Let Attackers Drain Bitcoin Wallets

Q: What hidden flaw allowed attackers to drain exposed Alby Hubs, and did victims lose everything?

The hidden flaw has not been publicly disclosed yet. Alby says only that in Alby Hub versions v1.7.0 through v1.18.5, an attacker who could reach the Hub’s internet-exposed management API could gain unauthorized access and send funds. The company is withholding the technical root cause for now under responsible disclosure, so reports that identify a specific bug mechanism go beyond what Alby has confirmed. What is clear is the exposure condition. The vulnerability mattered only when users had made the Hub reachable from outside their local network, such as by publishing Docker port 8080 on all interfaces or opening that port broadly in a cloud firewall. Alby has since changed documentation and Docker defaults to make clear that Hub is meant to stay on a private network and listen on localhost. As for losses, there is no confirmed public evidence that victims “lost everything.” Alby says one user is known to have been affected, but it has not disclosed whether any bitcoin was actually stolen or how much. Some secondary coverage suggested real financial harm was possible or likely, but the company itself has not confirmed the size of any loss. The practical takeaway is that the risk was wallet takeover and fund transfer from exposed, outdated Hubs, not from private or updated ones. Users who were exposed were told to cut off public access, upgrade to v1.24.0, and change their unlock password.

3 articles · Updated · The Hacker News · Sep 9

One user has been affected by a critical Alby Hub flaw that could let attackers take over a wallet and send funds if the management interface was exposed to the internet.
Versions v1.7.0 through v1.18.5 are affected, while v1.19.0 and later are not; Alby told users on older builds to first block outside access, then update to v1.24.0.
Port 8080 exposure is central to the risk: Alby says exposed users should change their unlock password after updating, but has not disclosed the bug or whether updating alone removes any attacker access.
Documentation changes on Sept. 7 added warnings against putting Alby Hub on the public internet and changed Docker defaults, even as some cloud setup guides still described internet-open configurations on Sept. 9.