BitBox has patched the firmware to fix two critical security flaws that would have led to hardware wallets being open to malicious firmware and Bitcoin getting locked into the wrong address. In a security advisory statement issued by BitBox, the first of the two flaws was identified as memory corruption in unconfigured Multi versions of the BitBox02 and BitBox02 Nova, while the second one had an impact on the wallet provider’s Silent Payments feature. According to BitBox, there were no reports of any users having their funds stolen through any of these vulnerabilities.
Security Update Follows Earlier Vulnerabilities Found Through Bug Bounty Programme
As per the announcement by BitBox, for the first vulnerability, BitBox explained that the wallet could be exploited via memory corruption by a malicious host connected to the device before it was set up with a wallet. In the event of successful exploitation, the host would be able to deploy malicious firmware, thus providing a channel for future compromise of funds, stated the firm. The second one was related to BitBox’s Silent Payments feature, and it could potentially enable the malicious host to lock Bitcoins on an undesired address.
According to BitBox, no exploit had yet been successfully deployed for this flaw, though there was some possibility of its impact on the program flow. In addition to this, at the beginning of January, the firm addressed two flaws in the BitBox02 Nova through their bug bounty programme. These flaws were categorised by the firm as being minor and moderate because exploitation required advanced physical access and applied only under specific conditions.
The BitBox security update follows a wave of hardware-wallet incidents involving devices and the services surrounding them, one of them being the Coldcard exploit in August. According to Galaxy Digital’s chief researcher, Alex Thorn, at least 15 different hackers have used this Coldcard vulnerability. Galaxy Research also stated that Coldcard-related losses had exceeded $112 million (roughly Rs. 1,072 crore), with about 1,778.6 BTC swept from more than 8,600 addresses.
In another data breach incident reported within the crypto industry in the last week. SafePal revealed that due to an authorisation vulnerability in the order tracking plugin, the order data of around 39,798 customers was at risk of being leaked. This data pertained to customers who had made their orders from March 2, 2025, through April 11, 2026, and included names, email addresses, shipping addresses, phone numbers, and purchase details.Â
