#sideswap暂停liquid服务
📢 公告背后的逻辑，进群聊
The Lightning Network sounded another alarm—this time with the widest impact yet. Today, Alby disclosed that older versions of Alby Hub, from v1.7.0 to v1.18.5, contain a serious vulnerability. As long as the Hub is exposed to the public internet, an attacker can bypass authorization and directly call the management interface to move funds out of it. Affected are versions released before August 2025. Starting from v1.19.0, it has been fixed. At present, only one user is confirmed to have been impacted, and it was even self-reported by that user.
The operation path isn’t complicated. The official guidance is three steps: first, check the version number you installed; if it’s an older version, immediately block public internet access, then upgrade to the latest v1.24.0 and change the unlock password. Most Lightning Network wallets run on users’ own nodes, unlike exchanges that can push a unified patch window—version fragmentation is where things get truly messy. Many people forget after installing, and vulnerability advisories never quite reach their hands.
Looking at this against the backdrop of August, it’s even more interesting. Last month, Boltz—also a core service provider in the Lightning ecosystem—was forced to pause operations after being hit by automated attacks sustained for months. At the time, the team’s exact words were that the attackers’ iteration speed had already surpassed what a small team could manage in finding vulnerabilities and shipping patches. This time, Alby’s vulnerability was also uncovered by a professional auditing team. Put together, the two incidents point to the same trend: AI-assisted vulnerability discovery is pulling the patch race pace beyond what human teams can keep up with.
The Lightning Network’s design philosophy is that users keep custody of their own funds. The premise assumes users can follow security bulletins, but in reality, patches always arrive half a step behind attacks. When the next similar advisory comes out, will you check your node version right away? Chat about it in the comments.
📢 公告背后的逻辑，进群聊
The Lightning Network sounded another alarm—this time with the widest impact yet. Today, Alby disclosed that older versions of Alby Hub, from v1.7.0 to v1.18.5, contain a serious vulnerability. As long as the Hub is exposed to the public internet, an attacker can bypass authorization and directly call the management interface to move funds out of it. Affected are versions released before August 2025. Starting from v1.19.0, it has been fixed. At present, only one user is confirmed to have been impacted, and it was even self-reported by that user.
The operation path isn’t complicated. The official guidance is three steps: first, check the version number you installed; if it’s an older version, immediately block public internet access, then upgrade to the latest v1.24.0 and change the unlock password. Most Lightning Network wallets run on users’ own nodes, unlike exchanges that can push a unified patch window—version fragmentation is where things get truly messy. Many people forget after installing, and vulnerability advisories never quite reach their hands.
Looking at this against the backdrop of August, it’s even more interesting. Last month, Boltz—also a core service provider in the Lightning ecosystem—was forced to pause operations after being hit by automated attacks sustained for months. At the time, the team’s exact words were that the attackers’ iteration speed had already surpassed what a small team could manage in finding vulnerabilities and shipping patches. This time, Alby’s vulnerability was also uncovered by a professional auditing team. Put together, the two incidents point to the same trend: AI-assisted vulnerability discovery is pulling the patch race pace beyond what human teams can keep up with.
The Lightning Network’s design philosophy is that users keep custody of their own funds. The premise assumes users can follow security bulletins, but in reality, patches always arrive half a step behind attacks. When the next similar advisory comes out, will you check your node version right away? Chat about it in the comments.