BitBox Releases Firmware Update to Address Severe Vulnerabilities in Wallets

BitBox, a manufacturer of Bitcoin wallets, has announced the release of firmware version 9.26.5, aimed at fixing two severe vulnerabilities and a silent-payment flaw identified during internal security audits that utilized advanced AI models. The company confirmed that there have been no reports of exploited vulnerabilities or stolen user funds, and wallet seeds remain secure.

One of the vulnerabilities previously addressed in version 9.26.2 involved a bootloader flaw that could have allowed an attacker to install malicious firmware on an authentic BitBox02 device by deceiving the user into installing a counterfeit BitBoxApp. However, this issue did not affect BitBox02 Nova devices, which utilize a newer bootloader.

A separate memory-corruption vulnerability was found in Multi-edition devices that had not been configured with a wallet and were connected to a malicious host. This flaw could have enabled arbitrary code execution and the installation of malicious firmware. The Bitcoin-only editions of the BitBox were not impacted by this issue.

The silent-payment flaw had the potential to redirect funds to an unintended address, which could facilitate ransom attempts, but it did not allow for direct theft. The latest firmware update rectifies both this issue and the memory vulnerability.

BitBox has urged all users to install the latest BitBoxApp from its official website and update their device firmware promptly to ensure their security.