BitBox has released a security update this week to address three vulnerabilities in its BitBox02 hardware wallet firmware, two of which were described as severe. These flaws could have potentially allowed attackers to load malicious firmware or lock funds to incorrect addresses. BitBox states there are no reports of stolen user funds and no reason for users to be concerned, emphasizing the importance of updating the firmware.
The security update, version 9.26.5, is available for download on BitBox’s official website. A previous fix for one of the bootloader issues was already included in the July release, version 9.26.2.
According to BitBox, AI models were utilized during its internal review process to help identify these vulnerabilities. This marks an increasing trend of artificial intelligence being employed in cybersecurity audits for hardware and software.
The BitBox02 Nova edition was not affected by all vulnerabilities, and the Bitcoin-only edition does not carry the affected code for one of the severe bugs. The first severe flaw was addressed in the July release, while the second severe bug, which could allow arbitrary code execution when paired with a hostile computer before the Multi edition is set up, is fixed in the latest update. The less dangerous third issue, related to the wallet’s silent-payment feature, could have locked funds to a wrong address, but not directly steal them.
BitBox has stated that there is no evidence the vulnerabilities were ever exploited in the wild before their discovery. The company stressed that users should update their firmware to the latest version to ensure their devices are protected.
This incident serves as a reminder that hardware wallets, while considered a secure method for storing cryptocurrency, are not immune to vulnerabilities. Recent events, such as the Coldcard exploit that reportedly coincided with the theft of approximately 1,596 Bitcoin (BTC) in 2026, and a data breach at hardware wallet maker SafePal, underscore the ongoing security challenges in the cryptocurrency hardware space. These events highlight the need for continuous vigilance and prompt updates from users to protect their digital assets.
Broader Context
The company disclosed the issues itself, with no evidence they were ever exploited.
Why This Matters
The discovery and patching of severe vulnerabilities in a prominent hardware wallet like BitBox, with the assistance of AI in identifying the flaws, underscores the ongoing need for vigilance and timely updates in crypto security. This event, alongside recent exploits in the hardware wallet sector, highlights that these devices, while robust, are not infallible and require continuous user attention to safeguard digital assets.
Leave a Reply