BitBox has revealed two serious security flaws in some of its hardware wallets, but the company said there is no evidence that any user funds were stolen or wallet recovery seeds were compromised.
The Zurich-based crypto wallet maker discovered the issues during internal security audits, which also involved testing with advanced AI models. The findings show that even hardware wallets, which are designed to keep crypto assets safer by storing sensitive information offline, can still have vulnerabilities in their underlying software.
Issue description
The first flaw affects BitBox02 Multi Edition devices and involves a memory-corruption issue. In simple terms, the problem could cause the device’s memory to behave in an unexpected way and potentially create an opening for an attacker. BitBox said its Bitcoin-only editions do not contain the affected memory code, so they were not vulnerable to this particular issue.
The second vulnerability involves the wallet’s bootloader, the software that helps start the device and load its firmware. BitBox said this issue was more serious than the company had previously described in July.
That does not mean an attacker could simply break into a wallet remotely, however. Exploiting the bootloader vulnerability required a successful phishing attack as well as the victim unlocking a device that had already been tampered with. In other words, an attacker would need to trick the user and gain access to the physical device before the vulnerability could potentially be exploited.
BitBox reveals third flaw
BitBox also disclosed a third flaw that could have resulted in funds being locked to an unintended cryptocurrency address. The company said there was no evidence that this vulnerability had been used to steal funds.
BitBox has already released fixes for the reported vulnerabilities through firmware version 9.26.5. The company also confirmed that wallet seeds, the recovery phrases that are essentially the keys to a user’s crypto, were not affected.
Not all BitBox devices were exposed to the same risks. The BitBox02 Nova, for example, was not affected by the bootloader vulnerability. Bitcoin-only versions of the wallet were also protected from the memory-corruption issue because they do not contain the relevant code.
For users, the disclosure is a reminder that hardware wallets are not completely immune to security problems. While they keep private keys away from many online threats, the software running on these devices still needs to be tested, updated and maintained.
The good news is that BitBox says it has found and patched the vulnerabilities before any known loss of funds occurred. Users with affected devices should therefore make sure their wallets are running the latest firmware.
Overall, the incident highlights both sides of hardware wallet security: offline storage can offer strong protection, but keeping the device’s firmware updated is just as important.
