Digital Wallet

Story: BitBox Patches Two Critical Firmware Flaws Before Any Funds Were Lost

By James Thorp

1 / 15

What the Two Flaws Actually Meant for Users. The memory corruption issue is worth unpacking a little more.

2 / 15

A Rough Stretch for Hardware Wallet Security. BitBox's disclosure didn't land in a vacuum. The hardware wallet sector has had a genuinely rough…

3 / 15

BitBox just pushed a firmware update. Version 9.26.5 is out, and it fixes two vulnerabilities the company called "severe" — the kind of word hardware wallet makers don't throw…

4 / 15

The first flaw hit Multi editions of the BitBox02 and BitBox02 Nova, but only on devices that hadn't been set up with a wallet yet.

5 / 15

No comment from BitBox beyond the disclosure itself.

6 / 15

The memory corruption issue is worth unpacking a little more. Hardware wallets that haven't been initialized yet are in a vulnerable state — they're essentially blank slates, and…

7 / 15

Silent Payments is trickier to explain. It's a privacy feature that lets Bitcoin senders pay someone without reusing addresses, which helps break transaction traceability.

8 / 15

Users still running older firmware should upgrade to 9.26.5. That's the clear takeaway.

9 / 15

BitBox's disclosure didn't land in a vacuum. The hardware wallet sector has had a genuinely rough run lately, and the timing makes the industry context hard to ignore.

10 / 15

See also: SafePal Data Breach Hits 39,798 Users but Crypto Assets Stay Safe

11 / 15

Coldcard, one of the most popular Bitcoin-focused hardware wallets, got hit with a vulnerability tied to a firmware change from March 2021.

12 / 15

Separately, both Trezor and SafePal dealt with data breaches that exposed customer information for more than 53,000 users combined.

13 / 15

So when BitBox drops a "severe" vulnerability disclosure, it lands against that backdrop. The industry's self-custody pitch — that keeping keys on a hardware device is safer than…

14 / 15

BitBox's approach here was proactive. Find the flaws, patch them, disclose publicly, urge users to update. That's the playbook, and they ran it before anyone got hurt.

15 / 15

Related: $4.8 Billion Cash Reserve Keeps Strategys Bitcoin Options Open

The Currency Analytics

Want the full story?