Loading story…
Alby disclosed a critical vulnerability in its self-hosted Lightning wallet, Alby Hub, that could allow an attacker to take over an internet-exposed wallet and transfer its bitcoin. The flaw affects versions 1.7.0 through 1.18.5; exploitation requires the Hub management web interface to be reachable from the internet. Alby knows of one affected user but has not said whether funds were stolen, and it has not released technical details of the vulnerability.
The issue was fixed in v1.19.0, while Alby recommends upgrading to v1.24.0. Organizations and users running affected exposed instances should immediately restrict external access, change the Hub unlock password, and contact Alby security. Alby also corrected documentation and Docker port-binding defaults after discovering they could imply localhost-only access even though the service listened on all network interfaces, increasing the chance of unintended internet exposure.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
Alby added warnings against directly exposing Alby Hub to the public internet, acknowledged prior localhost guidance was inaccurate, and changed Docker configuration to bind port 8080 only to the local machine.
Alby described a separate incident involving a clearnet-accessible Hub that had not completed setup and had no unlock password; an attacker completed its setup and emptied the wallet.
Alby released Alby Hub v1.19.0, the first version containing a fix for the critical vulnerability affecting internet-exposed Hub management interfaces.
Alby disclosed that versions v1.7.0 through v1.18.5 could allow attackers to take over an internet-exposed Alby Hub wallet and transfer bitcoin. The company said it knew of one affected user, did not confirm losses, and withheld technical details pending later responsible disclosure.
Following the separate publicly exposed Hub incident, Umbrel changed its Alby Hub app so users must pass through Umbrel's login protection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BTCPay Server issued an emergency warning after confirming active exploitation of a critical flaw that allowed attackers to compromise self-hosted payment servers and steal funds from connected **LND** Lightning nodes. The project told operators to upgrade immediately to **BTCPay Server 2.4.2** and **NBXplorer 2.6.10**, or shut systems down if patching was not possible. Public reports said affected users had channels closed and balances swept, and organizations including **Foundation** were identified among victims, while the total number of impacted deployments and losses remained unclear. Reporting tied the issue to BTCPay Server’s **Greenfield API** authentication flow, where HTTP Basic authentication could bypass two-factor protections for accounts using **TOTP** without a **FIDO2** credential. BTCPay said attackers were able to steal Lightning credentials, including **LND macaroons**, and warned that patching alone would not invalidate stolen secrets. Operators were instructed to rotate macaroons and related credentials and move funds from hot on-chain wallets created inside BTCPay, while the software was changed to enforce account-level 2FA checks and disable Greenfield Basic authentication by default shortly after account creation unless explicitly enabled.
Aug 10, 2026
Electrum developers disclosed and patched a **critical vulnerability** that allowed malicious websites to steal bitcoin from users of the popular wallet. Reports said the flaw affected older versions and could be triggered through website interaction, prompting urgent calls for users to upgrade to a fixed release. The risk persisted well beyond the initial patch cycle. Later reporting linked an old Electrum weakness to the theft of **1,400 BTC** from a user, while newer campaigns targeting Electrum wallets reportedly infected more than **150,000 hosts** and stole over **$4.6 million**. The incidents show that outdated wallet software and continued malware activity remained a significant threat to Electrum users even after the original vulnerability was addressed.
Jul 12, 2026
THORChain was exploited across Bitcoin, Ethereum, BNB Chain, and Base, with losses rising from an initial estimate of **$7.4 million** to more than **$10.7 million** after an Asgard vault was drained. The protocol paused trading after the attack, and community investigators published suspected theft addresses on Bitcoin and EVM-compatible networks. Separately, Alephium disclosed that its private Wormhole-fork TokenBridge was exploited on Ethereum and BNB Chain for about **$815,000** after an off-chain backend flaw let forged guardian messages pass through its four-guardian system, enabling the minting of **13.76 million** unbacked wrapped `ALPH` on Ethereum. New reporting tied the THORChain incident to a privately disclosed but allegedly unremediated proposer-forgery flaw in the Bifrost attestation system. Security firm **V12** said it warned THORChain about a critical fund-draining bug, but the protocol silently patched code, did not pay a bounty, and retired its bug bounty program; researchers said a May 6 fix intended to block proposer forgery failed automated testing and was never deployed before the exploit. In Alephium’s case, the project and Blockaid revised earlier claims of guardian key theft and said the root cause was forged malicious events or messages observed and signed because of a backend vulnerability; Alephium shut down the bridge, halted new transactions, and urged holders to pull liquidity from Uniswap and PancakeSwap while the attacker still controls the unbacked tokens.
Jun 29, 2026