Image Credit: Shutterstock
Hardware wallet maker BitBox has released firmware version 9.26.5 to fix two internally discovered vulnerabilities that could have enabled malicious firmware installation or locked Bitcoin at unintended addresses.
BitBox said it has received no reports that either flaw was exploited or caused users to lose funds. Existing wallet seeds are unaffected, but the company recommends that all users install the latest firmware.
Memory Flaw Affects Unconfigured BitBox Multi Devices Through 9.26.4
The first vulnerability involves memory corruption in Multi editions of the BitBox02 and BitBox02 Nova running firmware through version 9.26.4. It applies when a device has not yet been set up with a wallet and is used with a malicious host.
An attacker exploiting the flaw could execute arbitrary code and potentially install malicious firmware, which could lead to loss of funds.
BitBox’s Bitcoin-only editions are not affected because their firmware does not contain the vulnerable code. Firmware 9.26.5 fixes the issue.
Silent Payments Flaw Could Lock Bitcoin at Unintended Addresses
The second vulnerability alters BitBox’s Silent Payments implementation. A malicious host could manipulate a transaction so that Bitcoin is locked to an unintended payment address.
The flaw does not allow direct theft. BitBox said recovering affected coins could require cooperation between the attacker and intended recipient, potentially enabling a ransom attack. The company has received no reports of failed Silent Payments linked to the vulnerability.
BitBox02 and BitBox02 Nova devices running firmware versions 9.21.0 through 9.26.4 may be altered when creating a Silent Payment transaction with a malicious host. Version 9.26.5 fixes the flaw.
BitBox Details Separate Bootloader Flaw Patched in Earlier Firmware
BitBox also disclosed additional details about a separate bootloader vulnerability patched in an earlier firmware release. A successful attack could have used a fake BitBoxApp to persuade a user to install malicious firmware on an authentic BitBox02 and unlock the device.
BitBox now classifies that issue as severe because a successful exploit could have led to theft of user funds. BitBox02 Nova devices were not impacted by that attack path.
The company said its latest review included internal testing with frontier AI models alongside a record number of reports from external auditors. None of the external reports so far has identified a critical or severe issue.
Users can install firmware 9.26.5 through the BitBoxApp. BitBox said devices running the latest version are protected against all three security issues described in its August 17 disclosure.
