Key facts
- BitBox has released firmware version 9.26.5 to address two severe vulnerabilities.
- One vulnerability could have allowed attackers to install malicious firmware on unconfigured BitBox02 devices.
- A second flaw in the Silent Payments implementation could have locked Bitcoin to unintended addresses.
- BitBox has received no reports of these vulnerabilities being exploited or leading to fund losses.
- Users are advised to update to firmware version 9.26.5.
Hardware wallet manufacturer BitBox has issued a critical firmware update, version 9.26.5, to address two severe vulnerabilities. The first flaw, affecting Multi editions of BitBox02 and BitBox02 Nova not yet configured with a wallet, could have allowed a malicious host to execute arbitrary code and install compromised firmware, potentially leading to fund loss. The second vulnerability impacted BitBox's Silent Payments implementation, which could have enabled a malicious host to lock Bitcoin to an unintended address, though direct theft was not possible. BitBox emphasized that it has received no reports of either vulnerability being exploited or resulting in user fund losses. This disclosure follows recent security incidents involving other hardware wallets, including a Coldcard firmware flaw linked to over $112 million in Bitcoin thefts and data breaches affecting Trezor and SafePal customers.