Lightning Security Alert: Alby Reveals Critical Hub Vulnerability

Lightning Project Alby Confirms Critical Flaw successful Older Hub Versions

The squad disclosed the issue connected the societal media level X connected Wednesday, stating: “We person confirmed a captious vulnerability successful Alby Hub v1.7.0–v1.18.5 (releases anterior to August 2025) erstwhile the Hub is publically accessible from the internet.”

This vulnerability, the authoritative Alby X relationship wrote, could fto an attacker who tin scope the Hub’s absorption API get successful without support and nonstop funds.

Alby continued:

“Alby Hub v1.19.0 (released Aug 29, 2025) oregon newer are unaffected. As with immoderate incidental of this kind, we are profoundly atrocious — supra each for the users affected. To our existent knowledge, 1 idiosyncratic has been impacted and thankfully reported these details. We person poured each our vigor and resources of the past years into this project, and an contented similar this hits america hard.”

For radical who whitethorn beryllium affected by the bug, Alby says users should cheque which mentation they person installed archetypal thing. Then, if a idiosyncratic is connected an affected version, they request to marque definite to fastener down nationalist entree to their Hub’s absorption interface and update close distant to v1.24.0, the newest Alby Hub release. Alby besides thanked the Bitcoin Red Team developers who “reported respective issues, which person been fixed successful the latest release.”

Affected users who were exposed to the net should besides alteration their unlock password aft updating. The quality follows the caller contented with Boltz, different Lightning Network-centric protocol that provides a non-custodial bridge. The level fundamentally moves bitcoin betwixt the main chain, Lightning Network, and Liquid Network utilizing atomic oregon submarine swaps, which are HTLC-based. On Aug. 3, 2026, Boltz took swaps offline.

AI-Assisted Attacks Put Lightning Projects Under Pressure

At the time, the institution said this wasn’t conscionable 1 bug, but months of automated, artificial quality (AI)-assisted probing, a fewer contained exploits, and past a crisp acceleration. As they enactment it successful their authoritative statement, attackers “now iterate faster than a squad our size tin find and patch.”

After moving their ain AI-assisted scans, the Boltz squad said they couldn’t safely crook swaps backmost connected portion “multiple resourceful groups” were actively targeting them. The information of the substance is, AI is discovering bugs crossed the cryptocurrency ecosystem faster than ever earlier successful history.

Both projects are Lightning-adjacent, open-source, and “you support the keys” designs. Going forward, Alby’s squad stresses that users request to tally the latest mentation of the Hub. The steadfast besides said that users should debar exposing their Hub to the unfastened and nationalist internet. “We urge moving it down a firewall oregon wrong a backstage network,” Alby emphasized.