Community Trust ScoreVerified
BitBox just dropped an urgent firmware update for its BitBox02 hardware wallets. The update, named Dixence, patches several security flaws — two of them severe — and Dogecoin contributor Mishaboar is telling Bitcoin holders to move fast.
Mishaboar posted the alert on X, urging users to update their firmware right away. His advice went a step further than BitBox’s own guidance: do the update from a clean or freshly installed computer when you can. That’s not a requirement BitBox spelled out, but it’s a reasonable precaution given what’s at stake. Hardware wallets are supposed to be the safest option for storing crypto — private keys stay offline, away from phones and internet-connected computers. But the software layer is still a real attack surface, and Dixence makes that pretty clear.
Two Severe Flaws, Different Targets
The first critical flaw sits in the bootloader. Under certain conditions, an attacker could use a fake BitBox app to push malicious firmware onto the device. That’s a bad scenario — basically handing someone the keys to your wallet without realizing it. BitBox says the flaw was already fixed in version Oeschinen 9.26.2, so Dixence isn’t the first patch here, but the company is reinforcing the message. Worth noting: the BitBox02 Nova model isn’t affected by this one. It only hits older bootloader versions. And so far, BitBox hasn’t confirmed any actual exploitations tied to this flaw.
The second severe vulnerability targets the Multi edition specifically. It could trigger when an unconfigured device connected to a compromised computer — memory corruption becomes possible, and from there, malicious software could potentially get installed. Bitcoin-only editions are not affected by this second issue. That’s a meaningful distinction for users who went with the Bitcoin-only version, though it doesn’t mean they’re completely off the hook given the other flaws in the update.
A third issue rounds out the Dixence patch, and it’s a different kind of problem. It’s tied to silent payments. Unlike the first two flaws, this one can’t directly steal funds. But it can redirect payments — sending crypto to unintended addresses — and BitBox says that kind of scenario could lead to ransom demands. Unclear exactly what the ransom angle looks like in practice, but the company flagged it as serious enough to patch alongside the two critical vulnerabilities.
How to Update Without Getting Phished
BitBox’s instructions are specific. Download the official BitBoxApp from the official site — not from an email link, not from a social media post, not from anywhere else. Connect the wallet, unlock it, go to Settings, then Manage Device. A red dot will appear when a new firmware version is available. Confirm the update there. Do not disconnect the device while the installation runs. An incomplete installation could leave the device in a compromised state, which is arguably worse than not updating at all.
The phishing risk here is real. Attackers know that security alerts like this one create urgency, and urgency makes people click on things they shouldn’t. A fake firmware file delivered through email or a spoofed download page could do exactly the damage BitBox is trying to prevent. The company is pretty firm: authenticated firmware comes through the official app only.
Mishaboar’s clean-computer recommendation builds on that. Even with the right app and the right firmware file, a compromised machine could interfere with the process. It’s probably overkill for most users, but for anyone holding significant amounts of Bitcoin or other crypto, it’s not bad advice.
What BitBox Says About Exploits
BitBox has not reported any thefts connected to these vulnerabilities. No confirmed exploitations, no known victims. That’s good news, and it suggests the company moved fast enough to get the patch out before anyone took advantage of the flaws in the wild. But the absence of confirmed exploits doesn’t mean the vulnerabilities weren’t known outside BitBox — it just means nothing has been reported.
Users should also check their recovery words are still private and haven’t been shared or stored anywhere insecure. The firmware update handles the software side, but physical and operational security still matters. A patched device with a compromised seed phrase isn’t actually safe.
Hardware wallets carry a reputation for being the gold standard in crypto storage, and they mostly earn it. But Dixence is a reminder that “offline” doesn’t mean “invulnerable.” The software stack on these devices needs maintenance just like any other piece of security infrastructure. BitBox02 users who haven’t updated yet should probably stop reading and go do that now.
The Dixence update covers the bootloader flaw, the Multi edition memory corruption issue, and the silent payments redirect vulnerability. BitBox confirmed no exploits so far.
Hub: Bitcoin price, news, and analysis
Frequently Asked Questions
What is the Dixence update for BitBox02?
Dixence is a firmware update for BitBox02 hardware wallets that patches two critical security vulnerabilities — one in the bootloader and one affecting the Multi edition — plus a third flaw tied to silent payments that can redirect transactions.
Is the BitBox02 Nova affected by the Dixence vulnerabilities?
No. BitBox confirmed the bootloader vulnerability does not affect the BitBox02 Nova model, which only applies to older bootloader versions.
How did Mishaboar respond to the BitBox security alert?
Mishaboar, a Dogecoin contributor, posted the alert on X and advised Bitcoin holders to update their firmware immediately, adding a recommendation to perform the update from a clean or freshly installed computer when possible.
Why It Matters
The urgency surrounding the BitBox02 firmware update highlights the ongoing vulnerabilities within hardware wallets, which are often considered a secure option for storing cryptocurrencies. As the landscape of cyber threats evolves, incidents like this reinforce the importance of regular updates and best practices in securing digital assets, especially in a market where user confidence is paramount. This situation serves as a timely reminder for all crypto holders to remain vigilant and proactive in safeguarding their investments against potential attacks.
