Key facts
- BitBox released a firmware update to fix two critical vulnerabilities.
- One vulnerability could have allowed malicious firmware installation.
- Another vulnerability affected Silent Payments, potentially locking Bitcoin to unintended addresses.
- BitBox reported no exploitation or fund losses.
- Galaxy Digital confirmed losses from a Coldcard Bitcoin hack.
- Losses from the Coldcard hack reached $115 million.
- The Coldcard incident involved the theft of user funds from hardware wallets.
Hardware wallet manufacturer BitBox has issued a firmware update to resolve two significant security vulnerabilities discovered in its devices. The first vulnerability could have permitted the installation of malicious firmware onto the wallet. The second vulnerability impacted the Silent Payments feature, posing a risk of Bitcoin being sent to unintended addresses. BitBox has emphasized that no instances of exploitation of these flaws or any loss of customer funds have been reported.
In a related but distinct development, Galaxy Digital has confirmed the financial impact of a separate incident involving hardware wallets. The firm has stated that losses stemming from a Coldcard Bitcoin hack have now reached an estimated $115 million. This hack specifically involved the theft of user funds that were stored in Coldcard hardware wallets.