Alby confirmed a critical vulnerability in older Alby Hub versions that could let attackers gain unauthorized access and send funds, with at least one user known to be affected. Separately, BitBox warned that a phishing email impersonating the company, claiming a faulty random number generator, is circulating and telling users not to click links or enter seed phrases. The second one is worth noting precisely because it borrows the shape of a real incident, the Coldcard RNG failure from July, to make the lie plausible.