External Reporting发布于 12 小时前

BitBox patches ‘severe’ wallet flaws that could put funds at risk

BitBox recommended all users update to firmware version 9.26.5 and said it had received no reports of exploitation or fund losses.

作者 Cointelegraph by Ezra ReguerraPublisher Cointelegraph 2 分钟阅读

Image via Cointelegraph

>$112MColdcard theft losses

1,778.6 BTCBitcoin swept from wallets

13,689Trezor customers exposed

Why This Matters

The patched flaws highlight that a compromised host can undermine hardware-wallet security before or during setup, potentially enabling malicious firmware installation or misdirected Bitcoin payments. While no exploitation was reported, the disclosure reinforces heightened operational and supply-chain risk for self-custody users amid recent wallet vulnerabilities and customer-data leaks that can facilitate targeted attacks.

Security Context

Affected ecosystemHardware wallet firmware security

Affected providersBitBox · Coldcard · Trezor · SafePal

MitigationFirmware update released

Market Context

Bitcoin

BTC

$64,589

+0.39% 24h

Layer Index

Neutral

Layer Index

↑ 6 pts in 24h

Hardware wallet maker BitBox has released a firmware update that fixes two vulnerabilities it described as “severe” that could have enabled the installation of malicious firmware or put user funds at risk.

In a security disclosure on Monday, BitBox said one involved memory corruption affecting Multi editions of BitBox02 and BitBox02 Nova that had not been configured with a wallet. A malicious host could exploit it to execute arbitrary code and potentially install malicious firmware, which could lead to lost funds.

The second affected BitBox’s Silent Payments implementation and could have allowed a malicious host to lock Bitcoin to an unintended address. Direct theft was not possible, but an attacker could potentially demand a ransom to cooperate in recovering the coins, according to BitBox. The company said it had received no reports of either vulnerability being exploited or causing users to lose funds.

The disclosure comes at a sensitive moment for self-custody, after a Coldcard firmware flaw was linked to more than $112 million in Bitcoin thefts, underscoring how weaknesses in devices designed to protect private keys can become points of failure.

Cointelegraph reached out to BitBox for more information but did not receive a response before publication.

BitBox patch follows Coldcard thefts, wallet data leaks

The BitBox security update follows a wave of hardware-wallet incidents involving devices and the services surrounding them.

The most damaging was the Coldcard flaw, which traced to a March 2021 firmware change that went undetected for more than five years. The vulnerability affected wallet-seed randomness, allowing attackers to brute-force impacted wallet seeds and derive their private keys without physical access.

Galaxy Research said Friday that Coldcard-related losses had exceeded $112 million, with about 1,778.6 BTC swept from more than 8,600 addresses.

Related: Coldcard exploit pushes July losses to $247M as second-worst month of 2026

More recently, separate data breaches involving Trezor and SafePal exposed customer and order information belonging to more than 53,000 customers. Trezor attributed the exposure of 13,689 customers’ data to shipping provider ShipMonk, while SafePal said an authorization flaw in an order-tracking plug-in exposed details belonging to 39,798 customers.

Neither incident compromised devices, private keys or recovery phrases, but both companies warned that the information could enable targeted phishing and impersonation attacks.

Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?

Enjoyed this story?

Follow Cointelegraph by Ezra Reguerra and get alerted the moment their next story goes live.

突发新闻