BitBox yesterday released a security update for its BitBox02 wallets. Called Dixence, the patch addresses several vulnerabilities, including two considered severe. The next day, Dogecoin contributor Mishaboar relayed the alert and called on affected bitcoin holders to check their firmware without delay.
In brief
- BitBox reports two severe vulnerabilities as well as an issue affecting silent payments.
- The bootloader flaw had already been fixed with Oeschinen 9.26.2. Firmware 9.26.5, delivered with Dixence, fixes the other reported problems.
- No cases of exploitation have been identified to date. BitBox recommends only using its official application to perform the update.
BitBox02, multiple firmware versions are affected
BitBox02 is a hardware wallet that stores private keys in a device separate from the phone or computer. The BitBox02 presentation page already tested by Tremplin.io helps to situate the product, but the issue of August 17 is now software: BitBox recommends the latest version of its firmware.
The first flaw concerns the bootloader, the program responsible for launching the firmware at startup. According to the security bulletin published by BitBoxan attacker could, under certain conditions, push a user towards malicious firmware through a fake BitBox application. Once the device was unlocked, funds could then be at risk.
This problem was already fixed in Oeschinen 9.26.2. BitBox also specifies that the BitBox02 Nova is not affected by this attack, linked to old versions of the bootloader. To date, the company says it has not noted any cases of exploitation.
The second severe vulnerability affects the Multi edition. It could appear when an unconfigured device communicated with a compromised computer. Memory corruption could then allow code execution and, in the most serious scenario, the installation of malicious firmware.
The Bitcoin-only edition is not affected by this part of the problem.
We strongly recommend updating to the latest firmware in all cases to benefit from all security improvements.
The update must go through BitBoxApp
There is no question here of recovering a firmware file sent by email, messaging or social network. According to the official BitBox guidethe update is directly distributed in BitBoxApp.
You must first install the latest version of the application from the official website, connect the wallet, unlock it then go to “Settings” and “Manage device”. The update must then be confirmed directly on the BitBox02.
A red dot appears in the application when a new version is available. BitBox also asks not to unplug the device during installation.
Today, Mishaboar relayed the alert on X, calling on BitBox users to quickly update their devices. As reported U.Todayhe also advises carrying out the operation from a healthy computer, or even freshly installed when possible.
This last precaution comes from Mishaboar. For its part, BitBox especially emphasizes the use of the official application and the risks of phishing.
No operations confirmed at the moment
The alert is serious, but BitBox does not report any hacking in progress. The company says it has not received any reports showing that the bootloader or memory corruption flaws have already been exploited.
A third issue has also been fixed. It concerns silent payments. Unlike the two previous vulnerabilities, it did not directly allow funds to be stolen. However, it could block a payment to a different address than expected and, according to BitBox, create a scenario conducive to a ransom demand.
The case above all reminds us that a hardware wallet does not become invulnerable because the keys remain offline. Embedded software remains an essential component of security. Tremplin.io’s recent report on Coldcard had already illustrated this, even if the two situations remain different. In the case of BitBox, no theft linked to the announced vulnerabilities has been confirmed.
For affected users, the procedure remains simple: open BitBoxApp, check the firmware version and install the proposed update from the official application, without ever communicating the recovery words.
Our guide dedicated to crypto security finally reminds us that asset protection does not only depend on the choice of a hardware wallet, but also on the way in which it is used and kept up to date.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
