BitBox has patched two severe hardware-wallet flaws that could have let an attacker push malicious firmware onto a device or misdirect Bitcoin received through Silent Payments. The company says it found no evidence of exploitation, but the timing is a blunt reminder that hardware wallets are only as strong as the firmware under the hood.
- Two severe BitBox bugs were fixed in a firmware update.
- One flaw could have enabled malicious firmware installation on unconfigured devices.
- The other could have sent Silent Payments to the wrong address.
- No exploitation or user losses have been reported by BitBox.
- Coldcard’s seed-generation flaw is still fresh proof that firmware mistakes can have expensive consequences.
BitBox said the vulnerabilities affected its BitBox02 and BitBox02 Nova wallets, but not in the same way.
One issue was a memory corruption bug affecting unconfigured Multi editions of the BitBox02 and BitBox02 Nova. In practical terms, that means a malicious host device could potentially trigger a crash or memory overwrite before the wallet had even been set up. BitBox said that could lead to arbitrary code execution, the not-so-lovely phrase security researchers use when an attacker may be able to run their own code on a target device. BitBox Security Update: Addressing Vulnerabilities and
That matters because firmware controls how a hardware wallet behaves: how it signs transactions, handles keys, and talks to the outside world. If an attacker can tamper with that trust chain before setup is complete, the end result could be installation of malicious firmware onto a device. BitBox says the exposure was limited to devices that had not yet been configured.
The second issue involved Silent Payments, a Bitcoin privacy feature that lets users receive funds without publishing a fresh address each time. BitBox said the flaw could have caused Bitcoin to be credited to an unintended address, in other words, the wallet could derive the wrong destination in a transaction flow involving a malicious host device. The upgrade also drew attention to the company’s broader posture on device safety, especially as users compare options like D’Cent vs. Trezor: Best Hardware Wallet for Bitcoin and Crypto Security.
That is not the same as direct theft, and BitBox explicitly said direct theft was not possible through this vulnerability. Still, sending funds to an address the intended recipient does not control is a very real problem. “Not theft” is not exactly comforting when the money still ends up in the wrong place.
BitBox said it found no evidence that either vulnerability was exploited and had received no reports of users losing funds because of the flaws. That distinction matters. Serious bugs can exist without turning into real-world losses, and security teams deserve credit when they catch problems before criminals do.
The company says both issues were addressed in its latest firmware update. For users, the obvious move is to update now, not later, and not after one more round of “I’ll do it tonight.” BitBox patches 'severe' wallet flaws that could put funds at risk Hardware wallets are not set-and-forget magic boxes. They depend on code, and code needs maintenance.
BitBox also stressed that the details matter. The bootloader-related issue had a different scope from the memory corruption bug, and the Silent Payments flaw was tied to a specific transaction path. That kind of nuance can get lost fast when people flatten every wallet warning into the same generic panic. Not every model, edition, or firmware version is exposed in the same way. For anyone still wondering what a wallet actually is in crypto terms, the basic concept is simpler than the industry’s jargon circus: a cryptocurrency wallet is a tool for managing keys, not some magical vault that stores coins in a hardware box like gold bars in a bank.
That is one reason hardware-wallet security keeps making headlines. These devices are built to keep private keys offline and away from malware on general-purpose computers, which is still a huge improvement over leaving funds on a hot wallet or exchange. But offline does not mean invincible. A secure element helps. A metal shell helps. Bad firmware still ruins the party.
The BitBox disclosure also lands against a harsher backdrop for the hardware-wallet industry. BitBox is not the only vendor facing hard questions about trust, updates, and old vulnerabilities that continue to haunt users.
According to Galaxy Research, losses tied to a separate Coldcard issue exceeded $112 million. Coinkite, which makes Coldcard, said the problem stemmed from seed-generation randomness and affected certain firmware versions dating back to March 2021. The key lesson there is brutal but simple: if seed generation is flawed, a firmware update may not repair the damage. Users may need to move funds to a wallet created from a newly generated secure seed. Coinkite’s own warning, the Firmware Update Advisory for Coldcard Wallets: Addressing, is the sort of post nobody wants to need, but everybody should understand.
That is a very different kind of headache from BitBox’s bugs, but it points to the same ugly truth: wallet security is only as trustworthy as the code that creates and protects the keys. If the seed is bad, the foundation is bad. No amount of slick marketing can polish that turd. The lesson also applies to newer gear and product launches like the Trezor Safe 7: The First Transparent Secure Element in, where transparency and hardware design are being sold as security features rather than optional extras.
It also reinforces why recovery phrases and wallet seeds are sacred. Anyone who gets hold of a recovery phrase can usually recreate and control the wallet. That is why legitimate hardware-wallet providers do not ask customers to enter, scan, upload, or share recovery phrases through websites or other external channels. If a support form, QR code, or random message asks for it, the right response is not “maybe.” It is “absolutely not.”
For users comparing self-custody options or deciding whether one setup is worth the extra friction, there is no shortage of commentary, including guides like Coldcard Build Error Exposed Weak Seed Generation in Massive Bitcoin Hardware Wallet Theft. And while some BTC-focused grant work has pushed privacy and scaling forward, think Maelstrom’s Bitcoin Grant Program Funds Core, Payjoin and, the brutal reality is that every privacy feature and every custody tool still has to survive contact with messy humans and imperfect code.
Key takeaways
-
What did BitBox fix?
BitBox patched two severe vulnerabilities: one that could have enabled malicious firmware installation on unconfigured devices, and another that could have caused Silent Payments to be sent to an unintended address. -
Were users already robbed through these bugs?
BitBox says no. It found no evidence of exploitation and received no reports of users losing funds because of the flaws. -
Why is the Silent Payments issue serious if direct theft was not possible?
Because funds could still be credited to the wrong address. That can create real losses, confusion, and recovery headaches even without a classic theft path. -
Why does the Coldcard case matter here?
It shows how a seed-generation flaw can have lasting consequences. If the seed is weak, patching the device later may not fix the wallet that was already created. -
What should hardware-wallet users do now?
Update to the latest firmware, verify which device model and edition you’re using, and never enter a recovery phrase into a website, QR prompt, or support form.
The bigger takeaway is not that hardware wallets are broken. They are still one of the best tools for self-custody. The takeaway is that financial sovereignty comes with responsibility, and sloppy firmware or sloppy habits can blow a hole in even the best security setup.
That is the tradeoff. More control. Less hand-holding. Far fewer excuses.
“BitBox has released a firmware update fixing two severe vulnerabilities that could have exposed hardware wallet users to malicious firmware or caused Bitcoin to be locked to an unintended address.”
“The company said it had found no evidence that either vulnerability had been exploited and had received no reports of users losing funds because of the flaws.”
“Direct theft was not possible through the vulnerability, the company said.”
