Home
Cryptocurrency
Cryptocurrency News
BitBox Patches Security Flaws That Could Expose Wallets to Malicious Firmware

BitBox Patches Security Flaws That Could Expose Wallets to Malicious Firmware

BitBox has released firmware updates addressing two critical wallet vulnerabilities.

Written by Rahul Dhingra, Edited by Rohan Pal | Updated: 18 August 2026 19:16 IST

BitBox Patches Security Flaws That Could Expose Wallets to Malicious Firmware

Photo Credit: Unsplash/Franck

One flaw involved memory corruption while another could cause BTC to be locked at an unintended address

Click Here to Add Gadgets360 As A Trusted Source

Highlights

BitBox says no users have reported fund losses
One flaw could allow malicious firmware to be installed
Silent Payments bug could affect Bitcoin destination addresses

BitBox has patched the firmware to fix two critical security flaws that would have led to hardware wallets being open to malicious firmware and Bitcoin getting locked into the wrong address. In a security advisory statement issued by BitBox, the first of the two flaws was identified as memory corruption in unconfigured Multi versions of the BitBox02 and BitBox02 Nova, while the second one had an impact on the wallet provider's Silent Payments feature. According to BitBox, there were no reports of any users having their funds stolen through any of these vulnerabilities.

Security Update Follows Earlier Vulnerabilities Found Through Bug Bounty Programme

As per the announcement by BitBox, for the first vulnerability, BitBox explained that the wallet could be exploited via memory corruption by a malicious host connected to the device before it was set up with a wallet. In the event of successful exploitation, the host would be able to deploy malicious firmware, thus providing a channel for future compromise of funds, stated the firm. The second one was related to BitBox's Silent Payments feature, and it could potentially enable the malicious host to lock Bitcoins on an undesired address.

Crypto Scams Discussion

Explore More...

According to BitBox, no exploit had yet been successfully deployed for this flaw, though there was some possibility of its impact on the program flow. In addition to this, at the beginning of January, the firm addressed two flaws in the BitBox02 Nova through their bug bounty programme. These flaws were categorised by the firm as being minor and moderate because exploitation required advanced physical access and applied only under specific conditions.

Bitpanda Fined $81,000 by Austrian FMA in First Published MiCA Penalty

The BitBox security update follows a wave of hardware-wallet incidents involving devices and the services surrounding them, one of them being the Coldcard exploit in August. According to Galaxy Digital's chief researcher, Alex Thorn, at least 15 different hackers have used this Coldcard vulnerability. Galaxy Research also stated that Coldcard-related losses had exceeded $112 million (roughly Rs. 1,072 crore), with about 1,778.6 BTC swept from more than 8,600 addresses.

In another data breach incident reported within the crypto industry in the last week. SafePal revealed that due to an authorisation vulnerability in the order tracking plugin, the order data of around 39,798 customers was at risk of being leaked. This data pertained to customers who had made their orders from March 2, 2025, through April 11, 2026, and included names, email addresses, shipping addresses, phone numbers, and purchase details.

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Crypto Scams, Crypto Frauds, Crypto Security

Rahul Dhingra

Email Rahul Dhingra

Rahul Dhingra is a crypto writer at Gadgets 360, where he covers the exciting world of Cryptocurrency, Blockchain, Defi and Web3. Before joining Gadgets 360, he worked as a content specialist for a European-based Crypto Exchange. Rahul loves storytelling, not just through the written word but also through the visual medium. Beyond his professional life, Rahul is a sports fanatic. Whether it’s cricket or football, his passion for the game is contagious. More