BitBox disclosed two severe firmware flaws in its hardware wallets

Internal Audits Uncover Two Severe Flaws

@BitBoxSwiss, the Zurich-based hardware wallet maker, has released a firmware update after its own internal audits turned up two vulnerabilities it describes as severe. The update fixes two severe vulnerabilities discovered internally by the BitBox team, and also addresses a potential application of a flaw already fixed in the earlier Oeschinen update, which was later independently disclosed by an external researcher.

The company noted it received a record volume of security reports from external auditors, many of whom used frontier AI models to search for issues in its codebase, though none of those external researchers found a critical or severe problem.

The first vulnerability involved memory corruption affecting Multi editions of BitBox02 and BitBox02 Nova that had not been configured with a wallet. A malicious host could exploit it to execute arbitrary code and potentially install malicious firmware, which could lead to lost funds.

The Bitcoin-only edition is not affected by this part of the issue. The bootloader weakness, initially described in July, was found on closer review to be more serious than first disclosed. Exploiting it required a successful phishing attack and the user physically unlocking a tampered device.

No Stolen Funds, Fixes Shipped in 9.26.5

A third issue, tied to the Silent Payments feature, could have caused Bitcoin to be locked to an unintended address, creating a potential ransom-type leverage scenario. Unlike the two primary vulnerabilities, this flaw did not directly allow theft of funds.

There are no reports of stolen user funds, and there is no reason for users to panic. Wallet seeds were unaffected. BitBox firmware version 9.26.5 is not affected by any of the vulnerabilities covered in the August 17 disclosure. BitBox02 Nova devices are not affected by the older bootloader path.

Users should install updates through the existing BitBoxApp or the official BitBox website and never enter recovery words into a computer, website, or update prompt.

Sources:
BitBox official security disclosure: 08.2026 Dixence update
CoinTelegraph: BitBox Patches Code Execution and Bitcoin Lockup Flaws
Crypto.news: BitBox patches wallet flaws that could install malicious firmware