BitBox releases firmware updates to address “severe” security flaws affecting its hardware wallets. The company urges users to update to firmware version 9.26.5, saying it has not received reports of exploitation or users losing funds as a result of the vulnerabilities.
Across reporting, the issues are described as two distinct problems. One involves memory corruption in unconfigured BitBox02 Multi and BitBox02 Nova devices, which could let a malicious host install compromised firmware. The other affects the wallet’s Silent Payments feature, where a vulnerability could cause Bitcoin to be locked to an unintended address. BitBox states it has patched both vulnerabilities.
While outlets differ in how they phrase the potential impact—one emphasizes the risk to funds broadly and another specifies scenarios involving malicious firmware installation and incorrect address locking—both accounts attribute the need for updates to the same two classes of vulnerabilities and both note BitBox has not seen confirmed losses.
