flash on Nostr: ⚡️🚨 ALERT - BitBox Discloses Two Severe Hardware Wallet Vulnerabilities BitBox ...
⚡️🚨 ALERT - BitBox Discloses Two Severe Hardware Wallet Vulnerabilities
BitBox says there are no reports that any of the vulnerabilities were exploited or that user funds were stolen.
All disclosed issues are fixed in firmware v9.26.5, and BitBox is urging all users to update immediately.
Internal security audits uncovered two severe vulnerabilities, along with new details about a previously fixed bootloader flaw.
One vulnerability affecting BitBox Multi devices could allow a malicious host to execute arbitrary code and potentially install malicious firmware on devices that had not yet been set up.
Another flaw in Silent Payments could allow an attacker using a malicious host device to redirect funds to an unintended address, locking the Bitcoin and potentially enabling a ransom attack.
BitBox also disclosed that a previously patched bootloader vulnerability could have allowed an attacker to trick users into installing malicious firmware capable of stealing funds.
Published at
2026-08-18 05:51:48 UTCEvent JSON
{
"id": "f6983d86082a1fa2096958847855b1acad58e2498b4ad6340f6f40d60fe7bfc4",
"pubkey": "4d7842051782e0d3feb034d150adc2b6bae4ee3b49786793bffa468b6f5b96b3",
"created_at": 1787032308,
"kind": 1,
"tags": [
[
"imeta",
"url https://blossom.primal.net/e921e45a2feeb353fd363f2170a893f4b5a4d26bf1b2f07802a1d7a0b4b4e7cf.jpg",
"m jpeg",
"dim 2000.0x1125.0"
],
[
"client",
"Primal iOS"
]
],
"content": "⚡️🚨 ALERT - BitBox Discloses Two Severe Hardware Wallet Vulnerabilities\n\nBitBox says there are no reports that any of the vulnerabilities were exploited or that user funds were stolen.\n\nAll disclosed issues are fixed in firmware v9.26.5, and BitBox is urging all users to update immediately.\n\nInternal security audits uncovered two severe vulnerabilities, along with new details about a previously fixed bootloader flaw.\n\nOne vulnerability affecting BitBox Multi devices could allow a malicious host to execute arbitrary code and potentially install malicious firmware on devices that had not yet been set up.\n\nAnother flaw in Silent Payments could allow an attacker using a malicious host device to redirect funds to an unintended address, locking the Bitcoin and potentially enabling a ransom attack.\n\nBitBox also disclosed that a previously patched bootloader vulnerability could have allowed an attacker to trick users into installing malicious firmware capable of stealing funds.\nhttps://blossom.primal.net/e921e45a2feeb353fd363f2170a893f4b5a4d26bf1b2f07802a1d7a0b4b4e7cf.jpg",
"sig": "124c55712fe4dee85bd2ce0052edfd566339d16e9d83937dec07165c59c079dc313021f046c5046e097cca7bd03cec90b36765309e579cf37da540a31cfcdc37"
}
