BitBox patches ‘severe’ wallet flaws that could put funds at risk
Summary
BitBox released a firmware update fixing two severe vulnerabilities in BitBox02 Multi and BitBox02 Nova. One was a memory-corruption bug in unconfigured wallets that a malicious host could use to execute code and potentially install malicious firmware, risking user funds. The other affected Silent Payments and could have caused Bitcoin to be sent to an unintended address; direct theft was not possible, but recovery could have been extorted. BitBox said there were no reports of exploitation or losses. The patch lands amid wider hardware-wallet security concerns, including a Coldcard flaw tied to more than $112 million in Bitcoin thefts and separate Trezor and SafePal data leaks that exposed customer information but not private keys.
