alby

Bitcoin News на платформе X сообщил, что Alby подтвердил наличие критической уязвимости в Alby Hub v1.7.0 до v1.18.5. Если API управления будет доступен в публичной сети, злоумышленники могут получить несанкционированный доступ и перевести средства. В настоящее время известно о 1 пострадавшем пользователе, версии Alby Hub v1.19.0 и выше не подвержены этой уязвимости.Alby рекомендует пострадавшим пользователям ограничить доступ к интерфейсу управления из публичной сети, немедленно обновиться до v1.24.0 и изменить пароль разблокировки после обновления. Несколько проблем, о которых сообщали Bitcoin Team Red, Project Loupe и другие исследователи, также были исправлены в последней версии.

ChainCatcher news, Slow Mist founder Yu Xian released a follow-up update on "Alby hosted wallet balance being transferred by the platform," stating, "There are too many tricks with Alby. Although the funds have been refunded, the process of successfully withdrawing is cumbersome (though I completely understand the mechanism behind it). Ultimately, out of the $191, only $153 was successfully withdrawn, with over $30 worn away in the process."Previous report, Slow Mist's Yu Xian updated on social media, stating, "I got it back, without following the official required steps. It seems they refunded me directly... Happy Ending..."

ChainCatcher message, Slow Mist Yuxian updated on social media, stating, "Got it back, didn't follow the official required steps. It seems they just refunded me... Happy Ending...For other friends who have had this experience, if you haven't received your funds back, you can email the official inquiry (the official email is in the message where your funds were transferred), you can follow the required steps in the official reply (for example, you may need to pay to register for their Cloud or set up Alby Hub, etc.), but perhaps you can also do nothing like I did and get it back directly.The amount is small, but the nature is serious. If the official had left a message informing us of the retrieval method when they transferred our funds, the nature would have been very different."

ChainCatcher news, Slow Mist founder Yu Xian stated on the X platform that he is also a victim of the Bitcoin wallet Alby, with 0.00174788 BTC (191.96 USD) being transferred away from his Alby wallet. The transfer was possible because this is Alby's custodial account, and he was unaware of its platform agreement. By checking emails, it was found that Alby sent an email notifying users of an update to the platform agreement on May 1, 2025, and then this BTC was transferred away on May 26, 2025.ChainCatcher previously reported that multiple community users have reported their balances in the self-custody Bitcoin wallet Alby being "stolen," suspected to have been deducted by Alby officials. In the service terms updated by Alby in March 2025, it is stated: "Users have been notified for over a year to withdraw excess funds from their old Alby accounts created in 2023 and earlier that use the shared wallet architecture. To manage these long-inactive accounts more effectively, we reserve the right to deduct the entire remaining balance from accounts that have had no transaction activity (i.e., no completed transactions) for a continuous period of 12 months."

ChainCatcher message, multiple community users reported that their balances in the self-hosted Bitcoin wallet Alby were "stolen," allegedly deducted by Alby. Alby's updated terms of service in March 2025 state: "Users have been notified for over a year to withdraw excess funds from their old Alby accounts created in 2023 and earlier that use the shared wallet architecture. In order to manage these long-term inactive accounts more effectively, we reserve the right to deduct the entire remaining balance from such accounts after 12 consecutive months of no transaction activity (i.e., no completed transactions)."