🔐 Alby Warns of Critical Flaw in Bitcoin Lightning Wallet Software.

[DiMarxist]

I have not heard of this wallet before and I got the information from newsline today. There are more bitcoin attacks in this year than last two years in my experience of bitcoin.

"Bitcoin Lightning wallet provider Alby has disclosed a critical security vulnerability in older versions of its Alby Hub software that could allow attackers to take over wallets and drain funds without permission.

The flaw affects Alby Hub versions v1.7.0 through an unspecified later release. Crucially, it only impacts users who had made their Hub reachable from the internet — Alby Hub is a self-hosted Lightning wallet, meaning users run it on their own hardware or server. The company disclosed the issue on September 9, 2026, via X."

Source

[Catenaccio]

"Bitcoin Lightning wallet provider Alby has disclosed a critical security vulnerability in older versions of its Alby Hub software that could allow attackers to take over wallets and drain funds without permission.

It's flaw in their products, in older versions of Alby Hub software. It's limited with Alby Hub old versions only.

Many months ago, there were bad news about security on Bitcoin Lightning Network as I remember it was said by one of Bitcoin Lightning Network developer. Three years later, Bitcoin Lightning Network has still been used very widely.

In October 2023, Bitcoin Lightning Network faces security concerns.

[Antidote47k]

This is one of those instances where I'm having to re-think what people really mean by “self-hosted=safer”.
You may have your very own node as well as your own keys, not have a third party custodian, and at the same time put the wallet behind an internet-facing interface that is the weakest link. However, at that time the trust has not disappeared from the custodian, it's gone into the software, and how you've exposed the trust.

That’s probably the more difficult part of self custody, one can understand losing funds due to the fact that an exchange got hacked. What is more difficult to accept is that they are lost because the infrastructure that you personally operate was exposed in a manner that you were not aware of as being dangerous. It’s a very different lesson

[Ayers]

I have not heard of this wallet before and I got the information from newsline today. There are more bitcoin attacks in this year than last two years in my experience of bitcoin.

If you leave your node or hub port-forwarded to publicly exposed without regularly updating software then it is essentially like leaving the door wide open for hacker.

Afaik, there used to be some ambiguity regarding port binding in their official guide, which led some user to leave their ports open to public internet inadvertently. However, those using v1.19.0 or later version do not face this issue.

You are absolutely right. Recently, attack vector targeting Bitcoin and Lightning ecosystem have increased. However, these attack primarily exploit vulnerability in 3rd party software, node management panel or hot wallet.
Opting for self custody reduces your reliance on 3rd party. But it does not diminish your responsibility regarding security. If you wish to run your own Lightning node then you must also take charge of patching, password management, network exposure and configuration.

[OgNasty]

I wonder how many back doors have been built and are just awaiting AI to discover them. I think a lot of nefarious developers are going to be rugpulling their users in fear that if they don’t then someone with a lot of AI tokens will… Be careful out there. Now is not the time to be trusting layer 2s.

[Charles-Tim]

I wonder how many back doors have been built and are just awaiting AI to discover them. I think a lot of nefarious developers are going to be rugpulling their users in fear that if they don’t then someone with a lot of AI tokens will… Be careful out there. Now is not the time to be trusting layer 2s.

The OP gave people a wrong topic title. According to what he posted (excluding the topic title), it is not bitcoin lightning network that is vulnerable but their own Alby Hub versions v1.7.0 is what is affected and they are earning their users.

I think this thread should to be posted on wallet software or service discussion and not bitcoin discussion.

[NotATether]

I wonder how many back doors have been built and are just awaiting AI to discover them. I think a lot of nefarious developers are going to be rugpulling their users in fear that if they don’t then someone with a lot of AI tokens will… Be careful out there. Now is not the time to be trusting layer 2s.

The Alby bug is almost certainly not a backdoor. It's just frontier AI finding increasingly complex security vulnerabilies in different parts of software and chaining them together. A technique only mastered by the most experienced security researchers.

Unfortunately for us making the software, AI companies want our ID, a Yubikey, and thousands of dollars in token spend before they will find and fix the bugs in our own code. How is anyone supposed to afford this? It already forced Boltz owners to sell, and lnp2pbot to shut down.

[DiMarxist]

I wonder how many back doors have been built and are just awaiting AI to discover them. I think a lot of nefarious developers are going to be rugpulling their users in fear that if they don’t then someone with a lot of AI tokens will… Be careful out there. Now is not the time to be trusting layer 2s.

The OP gave people a wrong topic title. According to what he posted (excluding the topic title), it is not bitcoin lightning network that is vulnerable but their own Alby Hub versions v1.7.0 is what is affected and they are earning their users.

The topic said "Bitcoin Lightning Wallet Software." And not the network and in the body it has been expanded to the "Alby Hub versions v1.7.0" which is not included in the topic and topic is not where everything is included but the body explain it.