Via thecryptomerchant.com
Swiss hardware wallet maker patched two critical vulnerabilities in its BitBox02 devices after AI-assisted audits caught memory corruption and payment-routing bugs before any funds were stolen.
BitBox, the hardware wallet brand operated by Swiss firm Shift Crypto AG, disclosed two critical firmware vulnerabilities affecting its BitBox02 and BitBox02 Nova devices. The company says both flaws were identified through internal security audits that leveraged advanced AI models. The fixes shipped in the Dixence firmware update, version 9.26.5, which BitBox is urging all users to install immediately.
Neither bug was exploited in the wild, no funds were stolen, and existing wallet seeds remain unaffected.
What went wrong, and how AI caught it #
The first vulnerability involved memory corruption on unconfigured “Multi” edition devices. An attacker could potentially exploit this flaw to execute arbitrary code or install unauthorized firmware on a BitBox02 Multi that hadn’t yet been set up by its owner.
The second flaw targeted the Silent Payments feature. The bug could inadvertently lock user funds at incorrect addresses. BitBox emphasized that this particular issue couldn’t enable direct theft without cooperation from an attacker, making it an accidental-loss risk rather than a direct theft scenario.
BitBox also revisited a prior boot vulnerability that had been patched in firmware version 9.26.2. Upon further review, the company determined that flaw was actually more severe than initially assessed.
The broader hardware wallet security landscape #
BitBox operates an open-source model with a bug bounty program, which means external researchers can independently verify the firmware code. The company has been emphatic that users should update through official channels only, warning that firmware update announcements are prime territory for phishing attacks.
What this means for Bitcoin holders #
For anyone currently using a BitBox02 or BitBox02 Nova, the action item is straightforward: update to firmware version 9.26.5 through BitBox’s official app or website. Your existing seed phrase doesn’t need to change, but running outdated firmware after a public disclosure is an unnecessary risk. Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our