BitBox Patches Severe Vulnerabilities in Hardware Wallets

The first vulnerability involved memory corruption within unconfigured Multi editions of the BitBox02 and BitBox02 Nova. A malicious host connected to a new, uninitialized device could potentially execute arbitrary code, creating a pathway to install malicious firmware. Because firmware governs core cryptographic operations and transaction verification, BitBox categorized this flaw as severe for its potential to compromise device integrity.

A second issue affected the implementation of Silent Payments, a privacy feature that generates stealth addresses for Bitcoin transactions. An attacker could exploit this flaw to force Bitcoin to be locked to an unintended address, effectively rendering the funds inaccessible to the owner. While the vulnerability did not permit direct theft, it could have been used to coerce users into paying a ransom for the recovery of their assets.

These patches arrive amid heightened scrutiny of hardware wallet security across the industry. Recent disclosures have highlighted risks ranging from laser fault injection attacks on Trezor and Tangem devices to a long-standing firmware weakness in Coldcard wallets that resulted in over $112 million in losses. Unlike the Coldcard incident, which required users to generate entirely new seeds to ensure safety, BitBox users can mitigate these specific risks by updating their device firmware to the latest version.