Get the latest BitBoxApp here: bitbox.swiss/download

During our internal audits, we were able to discover and fix security issues in the BitBox firmware. This update comes with several important security improvements for the BitBox firmware, among other smaller bug fixes and improvements.

TL;DR: This update fixes two severe vulnerabilities in the BitBox firmware, which were internally discovered by the BitBox team. We also inform about a potential application of a vulnerability already fixed with the recent Oeschinen update, initially discovered internally and later disclosed independently by an external researcher. 

There are no reports of stolen user funds and there is no reason for users to panic. We recommend all users to update their BitBox devices to the latest firmware version, which fixes all security issues described in this article. 

Security first

Security will always remain the number one priority at BitBox, and this release is no exception. Through rigorous internal review and testing, including with frontier AI models, our team of engineers have found several security issues that are now being addressed with this release. In addition, an issue that has already been fixed in the past is more severe than previously reported, which we also want to inform our users about. 

As with all security updates, transparency is a key part of the process, which is why you can find more information about each vulnerability and their potential impact below. Our users expect us to discover, fix and address issues, and that’s exactly what we’re doing. We may share more technical information in a writeup at a later time.

Update on bootloader security issue

An exploit of an already fixed vulnerability with the recent Oescheinen release would have enabled an attacker to potentially manipulate users into installing malicious firmware on their devices. The exploit was initially discovered internally by BitBox engineers and later reported by external researchers.

This exploit can be categorized as severe, since it would enable an attacker to steal funds by having the user install malicious firmware on an authentic BitBox02. Apart from high technical finesse required by the attacker, this would first require a successful phishing attack on the user to get them to install the manipulated firmware, e.g. through a fake version of the BitBoxApp, and unlock their device.

Due to the age of specific bootloader versions where the exploit is feasible, the BitBox02 Nova is not affected.

This vulnerability has already been fixed with the Oeschinen release with firmware version 9.26.2. We have no reports that it has ever been exploited, and no reason to believe user funds have been stolen. 

Memory issue on Multi devices

Another severe vulnerability we discovered internally is about a memory corruption issue. It applies when the Multi edition of the BitBox has not been set up with a wallet yet and is used with a malicious host device. If exploited, it can enable arbitrary code execution and e.g. potentially also the installation of malicious firmware and with that, loss of funds.

The Bitcoin-only edition of the BitBox is not affected, as its firmware does not contain the affected code. 

The Dixence update fixes this vulnerability with firmware version 9.26.5. We have no reports that it has ever been exploited.

Silent Payment lock of funds 

During our internal audits, BitBox engineers found another potentially severe issue regarding the silent payments implementation. 

There is no direct theft of funds possible, but an attacker would have been able to lock the funds to an unintended payment address for a potential ransom attack, as cooperation between attacker and recipient would be necessary to recover such coins.

Since there were no reports of failed silent payments from our users, we have no reason to believe that this vulnerability has ever been exploited. It is fixed in the Dixence update with firmware version 9.26.5.

Am I affected?

Note that the range of affected devices differs between the vulnerabilities and exploits described above. This section covers all, providing full context of whether users are affected at a glance.

  • The BitBox02 on firmware versions through 9.26.1 may be affected if the user installs a malicious app bundled with malicious firmware, and installs it on their BitBox. 
  • The Multi edition of the BitBox02 and BitBox02 Nova through firmware version 9.26.4 are affected if there is no wallet set up on the device yet and it’s used with a malicious host device.
  • The BitBox02 and BitBox02 Nova from firmware version 9.21.0 through v9.26.4 may be affected if the user created a transaction to a silent payment address together with a malicious host device.
  • All BitBox devices on firmware versions from 9.26.5 are not affected.

Regardless of whether your device version and usage scenario may apply, we strongly recommend updating to the latest firmware version in any case, to benefit from all security improvements.

What should I do to stay safe?

As a BitBox user, all you have to do is update your firmware. To do this, click on the link inside the BitBoxApp to download the latest app version, plug in your BitBox and update to the new firmware version from the Manage device settings. See this guide if you need help with this.

Make sure you are on the official BitBox website bitbox.swiss when downloading the new app version. An easy way to avoid malicious search results or manipulated links is to just click on the update banner or app version directly from inside the BitBoxApp you already have installed. If you like, you can also verify the app signature yourself, making sure the BitBoxApp and its firmware update come directly from BitBox.

Note that on mobile devices, the BitBoxApp might update automatically in the background, in which case you would only need to manually update the BitBox firmware.

As always, be mindful of attackers that may use security announcements like this one to inflict fear and uncertainty through phishing email campaigns. BitBox will never ask for your recovery words and you should never enter them anywhere other than directly on your BitBox.

What are we doing to keep you safe?

The recent weeks have seen the most in depth review effort of our entire codebase, which is a good thing. Our team has spent countless hours going over the BitBox software stack. But audits are only useful if they find and fix issues. The Dixence release and its important security improvements are just one result of the ongoing effort of making the BitBox hardware wallets – and self-custody in general – as secure as possible.

Furthermore, we have received a record amount of security reports from external auditors, which mostly used modern AI models to search for issues in our code. So far, none of these external auditors has found a critical or severe issue. Some have even complimented us on the clean and organized code our team produces, which we’re very glad to hear.

We will reach out to our users through the BitBox News, announcement banners inside the BitBoxApp, as well as posts on social media – not to mention this blog article of course.

Last week, we also published an article detailing why in current times, with the steady progression of AI based code testing, it’s important you keep your hardware wallet firmware up to date. This release sets another example of why that recommendation is so important – not just for BitBox users, but all hardware wallets out there.

Miscellaneous improvements

This release also contains a few smaller security improvements and bug fixes:

  • Fixed an issue where swapping was not working correctly on iOS and iPadOS.
  • Fixed several smaller security issues identified through extensive internal audits of the firmware. The changes strengthen sensitive data handling, cryptographic operations, input validation, and protection against unexpected device states.

How can I stay up to date?

To get notified of security updates like these, new features and improvements, as well as other Bitcoin related topics, you can subscribe to the BitBox News.

As always, please do not hesitate to contact our support team if you have any questions.

Thank you for your continued support,

The BitBox team

Don’t own a BitBox yet?

Keeping your crypto secure doesn't have to be hard. The BitBox hardware wallets store the private keys for your cryptocurrencies offline. So you can manage your coins safely.

Both the BitBox02 Nova and the BitBox02 also come in a Bitcoin-only edition, featuring a radically focused firmware: less code means less attack surface, which further improves your security when only storing bitcoin.

Buy the BitBox02 Nova or grab a BitBox02 in our shop!

Shift Crypto is a privately-held company based in Zurich, Switzerland. Our team of Bitcoin contributors, crypto experts, and security engineers builds products that enable customers to enjoy a stress-free journey from novice to mastery level of cryptocurrency management. The BitBox02, our second generation hardware wallet, lets users store, protect, and transact Bitcoin and other cryptocurrencies with ease — along with its software companion, the BitBoxApp!

Photo of Lake Dix by Kevin Oetiker