Imagine buying a hardware wallet specifically because it is supposed to be the safest place to keep your crypto, then finding out months later that a flaw in it could have let a hacked computer take over the device. That is the scenario BitBox just closed the door on, before it happened to a single customer. The company shipped firmware version 9.26.5, a BitBox firmware patch that fixes two serious vulnerabilities in its BitBox02 hardware wallet, and it is a useful case study in how the self-custody world is getting more resilient, not less.
What the BitBox Firmware Patch Fixes
The first flaw was a memory-corruption bug in unconfigured BitBox02 and BitBox02 Nova Multi-edition devices. In the worst case, a malicious host computer could have used it to run arbitrary code on the wallet and potentially push malicious firmware onto the device.
The second issue lived inside BitBox’s Silent Payments feature, a Bitcoin privacy tool that generates a fresh receiving address for every transaction. A flaw in that logic could have let a malicious host lock bitcoin to an address the owner never intended, opening the door to a ransom-style scenario where an attacker holds the “correct” address for payment. Firmware 9.26.5 closes both holes.
Why This Is Good News, Not Bad News
Neither bug was exploited. BitBox says it has no reports of funds lost or of either flaw being used in the wild. That timing is the whole point: this patch caught and closed a vulnerability before it turned into a headline about stolen bitcoin, not after. Compare that to the pattern that has dogged the hardware wallet space recently, including a Coldcard firmware flaw linked to roughly $112 million in Bitcoin theft, plus separate data breaches at Trezor and SafePal. Decred followed the same playbook with its own emergency patch, catching a privacy flaw and fixing it quietly before anyone could exploit it.
For someone with a few thousand dollars in bitcoin sitting on a BitBox02, a patch like this is the difference between a five-minute firmware update and a potential total loss of savings. There is no dollar amount that captures avoiding that outcome, but the update itself costs nothing and takes only a few minutes through BitBox’s desktop app.
What Users Should Do Next
BitBox is recommending every user update to firmware 9.26.5 right away. Hardware wallet firmware updates have historically seen spotty adoption. Plenty of people set a device up once and never touch the update prompt again, which means the real-world security benefit of this patch depends on people actually installing it, not just on BitBox having shipped it.
For an industry built on the promise that self-custody is safer than trusting an exchange, this is a reminder that the promise only holds if hardware keeps getting audited carefully, and if vendors keep disclosing and fixing what they find instead of staying quiet. This one checks both boxes.
Source: Cointelegraph, “BitBox Patches Code Execution and Bitcoin Lockup Flaws”