BitBox Patches 'Serious' Vulnerabilities in Wallets That Could Have Put Funds at Risk

cryptonews.ruPublicado em 2026-08-18Última atualização em 2026-08-18

Resumo

Hardware wallet manufacturer BitBox has released a firmware update to fix two "serious" vulnerabilities. The first flaw, present in uninitialized BitBox02 Multi and BitBox02 Nova devices, was a memory corruption issue that could allow an attacker to execute arbitrary code and install malicious firmware, potentially leading to fund loss. The second vulnerability involved the implementation of Silent Payments, which could let an attacker redirect a user's bitcoin to an unintended address, though direct theft was impossible; an attacker could then demand a ransom to assist in recovering the coins. BitBox stated it has received no reports of these vulnerabilities being exploited or of user funds being lost. This disclosure comes during a sensitive period for the self-custody sector, following a major incident involving Coldcard wallets. A previously undetected firmware vulnerability in Coldcard, related to weak random number generation for seed phrases, has reportedly led to the theft of over $112 million in bitcoin from more than 8,600 addresses. Recent data leaks from Trezor and SafePal have also exposed information for over 53,000 customers combined, though these incidents did not compromise private keys or recovery phrases. The leaks could, however, facilitate targeted phishing attacks. BitBox did not respond to requests for additional comment by the time of publication.

Hardware wallet manufacturer BitBox has released a firmware update that patches two vulnerabilities which the company described as "serious." These vulnerabilities could have allowed the installation of malicious firmware, putting users' funds at risk.

In a security notice on Monday, BitBox detailed the first vulnerability—a memory corruption issue in uninitialized BitBox02 Multi and BitBox02 Nova versions. An attacker could exploit this flaw on the host device to execute arbitrary code and install malicious firmware, potentially leading to loss of funds.

The second vulnerability affected BitBox's implementation of Silent Payments and could allow an attacker to lock bitcoin at an unintended address. While direct theft was not possible, the attacker could demand a ransom to assist in recovering the coins, BitBox stated. The company added that it had not received any reports of the vulnerabilities being exploited or of user funds being lost.

The disclosure comes at a sensitive time for the self-custody sector. Earlier, a Coldcard firmware vulnerability led to the theft of over $112 million worth of bitcoin, demonstrating how weaknesses in devices designed to protect private keys can become single points of failure.

Cointelegraph reached out to BitBox for further comment but did not receive a response prior to publication.

BitBox Patch Released Following Coldcard Bitcoin Theft and Wallet Data Leaks

The BitBox security update follows a wave of incidents affecting hardware wallets and related services.

The most damaging was the Coldcard vulnerability, linked to a firmware change made in March 2021, which remained undetected for over five years. This vulnerability affected the generation of random values for the wallet seed phrase: attackers could brute-force find the seed phrases of affected wallets and obtain their private keys without physical access.

Galaxy Research reported on Friday that losses related to Coldcard exceeded $112 million. Approximately 17,786 BTC was withdrawn from more than 8,600 addresses.

Related: Coldcard exploit pushed July losses to $247,000,000, making it the second-worst month of 2026

Recently, separate data leaks at Trezor and SafePal exposed customer and order information for over 53,000 users. Trezor linked the leak of data for 13,689 customers to its delivery service provider ShipMonk, while SafePal stated that an authorization vulnerability in an order-tracking plugin exposed information for 39,798 customers.

In none of these incidents were the devices, private keys, or recovery phrases compromised. However, both companies warned that the exposed information could facilitate targeted phishing attacks and identity impersonation attempts.

Magazine: Do Coldcard attacks mean all hardware wallets are now unsafe?

end-content

Perguntas relacionadas

QWhat were the two serious vulnerabilities identified by BitBox in their hardware wallets, and what risks did they pose?

AThe first vulnerability was a memory corruption issue affecting unconfigured BitBox02 Multi and BitBox02 Nova devices. An attacker could exploit it to execute arbitrary code and install malicious firmware, risking fund loss. The second vulnerability was in the Silent Payments implementation, which could allow an attacker to lock a user's Bitcoin to an unintended address, enabling ransom demands.

QHow did the timing of BitBox's vulnerability disclosure relate to the broader security context for self-custody wallets?

AThe disclosure came at a sensitive time for the self-custody sector, following a major incident where a firmware vulnerability in Coldcard wallets led to the theft of over $112 million in Bitcoin, highlighting how weaknesses in private key storage devices can become failure points.

QWhat was the nature and impact of the Coldcard vulnerability mentioned in the article?

AThe Coldcard vulnerability, introduced in a March 2021 firmware update and undetected for over five years, affected the random number generation for wallet seed phrases. Attackers could brute-force the seed phrases of affected wallets, obtain their private keys, and steal funds without physical access, leading to losses exceeding $112 million from over 8,600 addresses.

QWhat other hardware wallet-related security incidents were mentioned besides Coldcard and BitBox?

ARecent data leaks from Trezor and SafePal were mentioned. Trezor's leak of 13,689 customer records was linked to a delivery service provider, ShipMonk. SafePal's leak of 39,798 customer records stemmed from an authorization vulnerability in an order-tracking plugin. No devices, private keys, or recovery phrases were compromised in these incidents.

QAccording to the article, what was a potential secondary risk associated with the Trezor and SafePal data leaks, even though no private keys were stolen?

ABoth companies warned that the leaked customer information could facilitate targeted phishing attacks and impersonation attempts against the affected users.

Leituras Relacionadas

3-Month Loss of $10 Billion, DAT Companies Begin to Return to Rationality

During the recent earnings season, major Digital Asset Treasury (DAT) companies reported staggering combined losses of approximately $10 billion for Q2 and over $30 billion for the first half, primarily due to markdowns on their bitcoin holdings. However, contrary to expectations, their stock prices have rebounded from June lows, indicating the market had already priced in these losses. The key shift is a collective return to rationality. Companies like Strategy, Sharplink, and Metaplanet are now prioritizing a new core metric: increasing the amount of crypto assets per share. This marks a departure from last year's aggressive growth-at-all-costs narrative. To achieve this, they are adopting disciplined capital allocation—issuing stock to buy crypto when trading at a premium, and halting dilution or initiating buybacks when at a discount. Some, like Strategy, have even broken "never sell" pledges to uphold this discipline. A major tool enabling this strategy is the STRC model—perpetual preferred shares offering high dividends (e.g., 12-13%) to raise fixed-income capital for purchasing bitcoin. Strive, Bitmine, and Metaplanet have launched their own variants. Sharplink pursues a different path, staking its vast Ethereum holdings to generate native yield. While the premium of DAT stocks over their underlying crypto asset value has declined and may not fully return, the model is evolving rather than ending. Stripped of hype, DAT firms are becoming actively managed, leveraged thematic funds. Their survival through massive losses and continued institutional investment (with major funds adding billions to positions during downturns) suggests the industry is maturing into a more calculated, long-term business focused on compounding crypto per share.

marsbitHá 1m

3-Month Loss of $10 Billion, DAT Companies Begin to Return to Rationality

marsbitHá 1m

PI Price Forecast Remains Stable at $0.086 as Pi Network Reforms App Economy

PI price forecast remains stable around $0.086 as it continues to trade below a key descending trendline from April. The token has been consolidating in a narrow range between $0.078 and $0.086 throughout August, with major EMAs positioned above the price indicating bearish pressure. Key resistance levels are identified at the 20-day EMA ($0.08772) and the SuperTrend indicators around $0.09-$0.10. Support sits at the current price and the August range low of $0.070. Fundamentally, Pi Network announced a major change to its App Studio pricing model, set for August 24, 2026. The fixed, subsidized rate of 0.25 Pi for app creation/editing will shift to a usage-based model reflecting actual AI service costs. Subsidized rates will remain for apps demonstrating genuine user adoption. Separately, the mandatory node protocol upgrade has reached version 26.1, with only version 27.1 remaining to complete the sequence. On-chain activity shows increased transaction volume, including patterns of repeated 0.03 Pi transfers, potentially related to testing following the protocol upgrade. The bullish scenario targets a break above the $0.08772-$0.09000 resistance cluster, opening a path toward the 50-day EMA at $0.09560. The bearish risk is a breakdown below the consolidation range, potentially testing the $0.070 support level. The conclusion notes that while fundamental developments are progressing, the price chart remains technically constrained until it can decisively break above the persistent downtrend line and key moving averages.

cryptonews.ruHá 5m

PI Price Forecast Remains Stable at $0.086 as Pi Network Reforms App Economy

cryptonews.ruHá 5m

"We have long ceased to be a crypto company": Tether CEO made a statement after KPMG audit

Stablecoin giant Tether has engaged Big Four auditor KPMG to verify its reserves, including a physical count of roughly 150 tons of gold in a Swiss vault. The audit confirmed the gold is present and that Tether's total reserves exceed its liabilities by $6.8 billion. CEO Paolo Ardoino described the process as "a physically heavy exercise" in an interview with Fortune. The audit aimed to address a long-standing conspiracy theory in the crypto world that USDT is not properly backed and could face a mass default. In a significant statement, Ardoino declared, "We haven't considered ourselves a crypto company for a long time. I think we are a digital dollar and digital gold company." He noted Tether has over 650 million users globally, with a strong focus in Africa and South America, where demand for stable digital assets is high due to recurring currency devaluations. Beyond financial services, Tether has been investing in decentralized communications, agriculture, and solar-powered kiosk networks for low-cost autonomous electricity. The company's next strategic move is to provide basic AI services to its user base in developing countries. Ardoino emphasized that even in the poorest nations, most people have a mobile phone capable of running simple AI models. The goal is to offer affordable, fundamental tools in sectors like healthcare, finance, and sports for a few dollars per month, payable via Tether or other digital payments. Ardoino expressed concern about societal inequality transforming from a wealth gap into a deeper "intellectual gap."

cryptonews.ruHá 5m

"We have long ceased to be a crypto company": Tether CEO made a statement after KPMG audit

cryptonews.ruHá 5m

A Leading Wall Street Market Maker Increases Bitcoin ETF Holdings to Over $1 Billion!

Wall Street market maker Jane Street significantly increased its Bitcoin ETF holdings in the second quarter of 2026, according to an SEC 13F filing. The firm purchased approximately $630 million worth of Bitcoin ETF shares during the quarter, bringing its total assets in such ETFs to $1.06 billion. This marks a strategic shift from the first quarter when Jane Street had reduced its Bitcoin ETF positions by roughly 71%. Market experts view this substantial investment as a significant signal, suggesting renewed institutional interest in Bitcoin despite recent price volatility. The move bolsters expectations that long-term outlook for the cryptocurrency remains positive. Analysts note that U.S. spot Bitcoin ETFs have become a crucial gateway for institutional investors, and Jane Street's purchases indicate institutional demand persists. The ongoing adoption of Bitcoin through ETFs by major financial players is seen as a key indicator for the market's medium to long-term prospects.

cryptonews.ruHá 7m

A Leading Wall Street Market Maker Increases Bitcoin ETF Holdings to Over $1 Billion!

cryptonews.ruHá 7m

Smartphones and Computers Will Become More Expensive: Ministry of Industry and Trade Plans to Collect 136 Billion Rubles from Electronics Buyers

Russia's Ministry of Industry and Trade plans to introduce a new mandatory "technological levy" on imported and domestically produced electronics, starting December 1, 2026. Unlike earlier proposals, a previously planned 5,000-ruble cap per device has been removed from the draft rules, which could lead to significantly higher charges. The ministry estimates the levy will raise 136 billion rubles over six years, with funds earmarked to support the domestic microelectronics industry. The levy applies to electronic components and finished products like smartphones, computers, and telecommunications equipment. While businesses will formally pay the fee, the cost is expected to be passed on to consumers through higher retail prices, potentially most affecting budget devices. This move may also reduce the variety of products available if importing certain models becomes unprofitable. The plan has raised concerns. A legal conflict exists as the current law still includes the 5,000-ruble cap. Additionally, the specific rates and calculation method for devices like smartphones remain unclear. Experts compare it to a similar levy on vehicles, where rates and exemptions were frequently revised. The collected funds will supplement, not replace, other state and private investments in the microelectronics sector. The levy's ultimate impact on device affordability and industry support will depend on final regulations and implementation.

cryptonews.ruHá 7m

Smartphones and Computers Will Become More Expensive: Ministry of Industry and Trade Plans to Collect 136 Billion Rubles from Electronics Buyers

cryptonews.ruHá 7m

Trading

Spot
活动图片

Categorias popularesright-arrow

Etiquetas Popularesright-arrow