BitBox Issues Urgent Fix for Severe Wallet Vulnerabilities

BitBox, the Swiss maker of self-custody hardware wallets, has released a firmware update to address two security issues it describes as “severe.” The company says the fixes reduce the risk of malicious firmware installation and prevent scenarios involving its Silent Payments feature that could cause Bitcoin to be locked to an unintended address.

BitBox reported that it has not received any information indicating either vulnerability has been exploited in the wild or that users have lost funds as a result. Still, the disclosure lands amid a broader run of hardware-wallet-related security concerns, including a Coldcard flaw that was later linked to losses exceeding $112 million, according to Galaxy Research.

Key takeaways

• BitBox’s latest firmware update targets two vulnerabilities it labels “severe,” including a memory corruption issue that could allow arbitrary code execution in unconfigured wallet states.
• The update also addresses a Silent Payments weakness that could enable Bitcoin to be locked to an unintended address, creating a potential ransom-type leverage scenario.
• BitBox says it has seen no reports of exploitation or user fund loss tied to either issue.
• The release arrives after high-profile incidents spanning hardware wallet devices and the services around them, including a Coldcard issue tied to large BTC theft totals.

What BitBox says the firmware flaws could enable

In a security disclosure released on Monday, BitBox said one of the vulnerabilities stems from memory corruption affecting “Multi editions of BitBox02 and BitBox02 Nova” when those devices have not been configured with a wallet.

BitBox explained that, under certain conditions, a malicious host could exploit the bug to execute arbitrary code and potentially install malicious firmware. If successful, that chain of events could expose user funds by altering how the device signs transactions or operates.

The second issue relates to BitBox’s Silent Payments implementation. BitBox said the vulnerability could allow a malicious host to lock Bitcoin to an unintended address. While the company stated that the flaw does not enable direct theft in the way some vulnerabilities do, it argued an attacker could still use the situation to demand a ransom in exchange for cooperation on recovering the coins.

Why the update matters for self-custody users

Hardware wallets are designed to minimize the amount of trust users must place in online systems. Even so, the BitBox disclosure highlights an important nuance: the device is not only responsible for protecting private keys, but also for maintaining a secure operating environment under all possible states—including those that occur before a wallet is configured.

For users, this is a practical reminder to keep firmware current, especially when device behavior can be influenced by connected hosts during setup or ongoing interactions. BitBox’s emphasis on “unconfigured” wallets suggests there is risk concentrated in specific device states rather than a universal exposure across all usage patterns. Still, the company’s decision to classify both bugs as severe indicates the potential outcomes are serious enough to warrant immediate action.

The timing: hardware-wallet incidents beyond device code

BitBox’s update arrives at a moment when the hardware wallet narrative has been dominated not only by device-level flaws, but also by problems in surrounding ecosystems—such as shipment and order-management systems.

Earlier, Cointelegraph reported on a Coldcard flaw that was traced to a March 2021 firmware change and reportedly remained undetected for more than five years. That vulnerability affected wallet-seed randomness. According to Galaxy Research, that defect enabled attackers to brute-force impacted wallet seeds and derive private keys without physical access. Galaxy Research said Coldcard-related losses exceeded $112 million, and reported approximately 1,778.6 BTC swept from more than 8,600 addresses.

More recently, separate data breaches involving Trezor and SafePal exposed customer and order information for more than 53,000 customers. Cointelegraph coverage noted that Trezor attributed exposure affecting 13,689 customers’ data to shipping provider ShipMonk. SafePal, meanwhile, said an authorization flaw in an order-tracking plug-in exposed details tied to 39,798 customers. In both cases, Cointelegraph reported that the incidents did not compromise device private keys or recovery phrases, but both companies warned the information could be used for targeted phishing and impersonation attempts.

These episodes underline a broader reality: self-custody security is shaped by a chain of components—device firmware, host-side software interactions, and operational services that handle customers and transactions. Even when devices themselves remain uncompromised, attackers may still exploit human and process-level weaknesses to increase the odds of successful fraud.

What investors and builders should watch next

BitBox says there are no reports of exploitation tied to either vulnerability, but the company’s disclosure nonetheless reinforces the need for disciplined update practices across the hardware wallet stack. The next signal to monitor is whether BitBox’s patch becomes the new baseline for Multi editions of BitBox02 and BitBox02 Nova users, and whether Silent Payments-related guidance triggers further clarification from the company about conditions under which users could be exposed.

For the industry, the broader question is how quickly manufacturers respond after audits or research uncover weaknesses—and how effectively they communicate practical mitigation steps to users who may not follow security advisories closely.