alby

Bitcoin News đã đăng trên nền tảng X cho biết, Alby xác nhận rằng Alby Hub v1.7.0 đến v1.18.5 có lỗ hổng nghiêm trọng, nếu API quản lý bị lộ ra công cộng, kẻ tấn công có thể có quyền truy cập không được phép và chuyển tiền. Hiện tại đã biết có 1 người dùng bị ảnh hưởng, Alby Hub v1.19.0 và các phiên bản cao hơn không bị ảnh hưởng.Alby khuyến nghị người dùng bị ảnh hưởng hạn chế truy cập công cộng vào giao diện quản lý, ngay lập tức cập nhật lên v1.24.0 và thay đổi mật khẩu mở khóa sau khi cập nhật. Nhiều vấn đề được báo cáo bởi Bitcoin Team Red, Project Loupe và các nhà nghiên cứu khác cũng đã được sửa trong phiên bản mới nhất.

ChainCatcher news, Slow Mist founder Yu Xian released a follow-up update on "Alby hosted wallet balance being transferred by the platform," stating, "There are too many tricks with Alby. Although the funds have been refunded, the process of successfully withdrawing is cumbersome (though I completely understand the mechanism behind it). Ultimately, out of the $191, only $153 was successfully withdrawn, with over $30 worn away in the process."Previous report, Slow Mist's Yu Xian updated on social media, stating, "I got it back, without following the official required steps. It seems they refunded me directly... Happy Ending..."

ChainCatcher message, Slow Mist Yuxian updated on social media, stating, "Got it back, didn't follow the official required steps. It seems they just refunded me... Happy Ending...For other friends who have had this experience, if you haven't received your funds back, you can email the official inquiry (the official email is in the message where your funds were transferred), you can follow the required steps in the official reply (for example, you may need to pay to register for their Cloud or set up Alby Hub, etc.), but perhaps you can also do nothing like I did and get it back directly.The amount is small, but the nature is serious. If the official had left a message informing us of the retrieval method when they transferred our funds, the nature would have been very different."

ChainCatcher news, Slow Mist founder Yu Xian stated on the X platform that he is also a victim of the Bitcoin wallet Alby, with 0.00174788 BTC (191.96 USD) being transferred away from his Alby wallet. The transfer was possible because this is Alby's custodial account, and he was unaware of its platform agreement. By checking emails, it was found that Alby sent an email notifying users of an update to the platform agreement on May 1, 2025, and then this BTC was transferred away on May 26, 2025.ChainCatcher previously reported that multiple community users have reported their balances in the self-custody Bitcoin wallet Alby being "stolen," suspected to have been deducted by Alby officials. In the service terms updated by Alby in March 2025, it is stated: "Users have been notified for over a year to withdraw excess funds from their old Alby accounts created in 2023 and earlier that use the shared wallet architecture. To manage these long-inactive accounts more effectively, we reserve the right to deduct the entire remaining balance from accounts that have had no transaction activity (i.e., no completed transactions) for a continuous period of 12 months."

ChainCatcher message, multiple community users reported that their balances in the self-hosted Bitcoin wallet Alby were "stolen," allegedly deducted by Alby. Alby's updated terms of service in March 2025 state: "Users have been notified for over a year to withdraw excess funds from their old Alby accounts created in 2023 and earlier that use the shared wallet architecture. In order to manage these long-term inactive accounts more effectively, we reserve the right to deduct the entire remaining balance from such accounts after 12 consecutive months of no transaction activity (i.e., no completed transactions)."