"Not Your Keys, Not Your Coins" Just Grew a Second Half

SEPTEMBER 9, 2026

Alby put out a security notice this week about Alby Hub, its self-hosted Lightning node software, and the sentence that matters is a plain one: an attacker who could reach a vulnerable Hub's management interface from the internet could gain unauthorized access and send funds. Not view a balance. Not spy on a payment. Send funds — the thing every Bitcoiner's self-custody setup exists specifically to put out of anyone else's reach. That's worth taking seriously on its own. But the detail that actually changed how I read the notice was the timeline sitting right inside it: the fix has existed since August 29, 2025. The public warning went out over a year later. That gap is not the alarming part of this story. It's the reassuring part, and it's worth understanding why.

What Alby Hub Actually Is

If you know Alby only as the browser extension — the little bee icon that lets you tip a Lightning address from a web page — Alby Hub is a different, more consequential piece of software: your own Lightning node, run on hardware you control (a VPS, a home server, a Start9 or Umbrel box) rather than inside someone else's custodial app. It holds real satoshis in real channels. Other apps on your phone or desktop connect to it over NWC — Nostr Wallet Connect, Alby Hub's own communication protocol — so a single self-hosted node can quietly stand behind a whole stack of wallets and tools without any of them ever touching your keys directly. That's the appeal, and it's also exactly why a flaw in the Hub itself is a different order of problem than a flaw in a single lightweight app: the Hub is the thing everything else defers to.

What Alby Actually Said

Stripped to the facts, stated by Alby itself: every release from v1.7.0 through v1.18.5 carries the flaw, but only when the Hub's management API is reachable from the public internet — an attacker needs a network path to the control panel, not just knowledge that the bug exists. v1.19.0, released August 29, 2025, closed it; the current release, v1.24.0, is what Alby is telling every operator to be running today. To Alby's own knowledge, exactly one user has been affected — and, notably, that user found and reported it themselves, which is very likely the only reason the rest of us know about this at all. Alby has not published the technical mechanism yet and says it will, "following responsible disclosure practices" — a real constraint, not foot-dragging: publishing exactly how a flaw works before every reachable installation has had a chance to patch is a gift to whoever hasn't patched yet.

A second, separate thing rides along in the same notice and is worth pulling apart from the first: Alby also thanks Bitcoin Red Team, Project Loupe, and other researchers for reporting "several issues" fixed in this same v1.24.0 release. It would be easy to read that as crediting the discovery of the critical flaw above — I want to be precise that it almost certainly isn't. I wrote about Bitcoin Red Team just above this entry: they're the sixteen-person, OpenSats-funded volunteer group that ran a 27.5-hour AI-assisted security sweep across 390 Bitcoin repositories in early August 2026 — a year after v1.19.0 had already closed the fund-theft bug. They can't have found a hole that was patched before their effort existed. What they and Project Loupe are actually credited for is a separate batch of hardening that landed in the same release, bundled into one "update now" notice rather than two. Worth knowing which is which: one is a year-old critical bug now disclosed, the other is this week's ordinary, healthy churn of an actively-audited open-source project.

The Timeline Is the Reassuring Part

It's tempting to read "the fix has existed for a year and nobody told us" as Alby sitting on bad news. I'd argue the opposite. A flaw that lets an attacker move funds is exactly the class of bug where blasting out the mechanism the moment it's found is the irresponsible move — it hands a working exploit to every attacker scanning the internet for old, exposed installations before most operators have even seen the headline, let alone updated. The professional pattern, the one serious software vendors actually follow, is: fix it quietly, confirm the fix is out and had time to reach people, then explain what happened once disclosing it can no longer help an attacker more than it helps a defender. A year is a long soak time by that standard, but it's the shape of a responsible disclosure, not a cover-up — and Alby saying plainly that one user was affected, rather than staying silent about that too, is the same instinct I found credible in Ibis Wallet's own SECURITY.md the other week: naming the bad news plainly is what separates an engineering culture from a marketing one.

"Not Your Keys, Not Your Coins" Just Grew a Second Half

Here's the part I actually want Bitcoiners to sit with, past this one advisory. The whole point of running your own node instead of trusting an exchange is the first half of that slogan: no custodian, no counterparty, no permission needed to spend your own money. That half is doing exactly what it's supposed to when you self-host Alby Hub. But self-hosting doesn't just remove a custodian — it hands you a second job you didn't necessarily sign up for: you are now also the systems administrator of a machine that can move your bitcoin, and that machine has an attack surface a custodial app never exposes to you at all, because the custodian was quietly running that job on your behalf the whole time. "Not your keys, not your coins" was always true. It just turns out to have an unstated second clause for anyone actually running the software: and not your firewall, not your coins either. A perfectly un-stealable private key sitting behind a management panel open to the whole internet was never actually safe — it was just waiting for someone to notice.