Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC 
DOGE BitBox releases security update to fix two critical vulnerabilities
Yesterday, BitBox released a security update called Dixence for its BitBox02 wallet. The patch fixes multiple vulnerabilities, two of which were identified as severe. The next day, Dogcoin contributor Mishaboar forwarded the alert and urged affected Bitcoin holders to check their firmware as soon as possible.
Overview
BitBox reported two critical vulnerabilities, as well as an issue that affected silent payments. The boot loader vulnerability has been fixed in Oeschinen version 9.26.2. The firmware version 9.26.5 provided by Dixence solves other reported issues. As of now, no cases of exploitation have been found. BitBox recommends updating only through its official app.
Multiple firmware versions of BitBox02 are affected
BitBox02 is a hardware wallet that stores private keys in a device that is separate from your phone or computer. As of August 17, the issue was software related: BitBox recommends using the latest version of firmware.
The first vulnerability involves the boot loader, the program responsible for loading firmware at boot time. According to a security bulletin issued by BitBox, attackers may guide users to install malicious firmware through forged BitBox applications under certain conditions. Once the device is unlocked, funds may be at risk. This issue has been fixed in Oeschinen version 9.26.2. BitBox also clarified that BitBox02 Nova is not affected by this attack, which is related to older versions of the boot loader. As of now, the company said it has not detected any cases of exploitation.
The second critical vulnerability affects the Multi version. The vulnerability may be triggered when an unconfigured device communicates with an infected computer. Memory corruption can cause code execution and, in the worst case, malicious firmware can be installed. Bitcoin-only versions are not affected by this issue. We strongly recommend updating to the latest firmware version in all cases to enjoy all security improvements.
Updates must be made via BitBoxApp
Never download firmware files sent via email, instant messaging or Social networks here. According to official guidelines, updates are distributed directly through BitBoxApp. You must first install the latest version of the application from the official website, connect to your wallet, unlock it, and then go to "Settings" and "Manage Devices". Updates must then be confirmed directly on BitBox02. When a new version is available, a red dot appears in the application. BitBox also requires users not to disconnect devices during the installation process.
Today, Mishaboar forwarded an alert on X, urging BitBox users to update their devices as soon as possible. He also recommends doing this from a clean or even newly installed computer, if possible. This last precaution came from Mishaboar personally. BitBox mainly emphasizes the use of official applications and warns of the risk of phishing.
Not confirmed to be utilized so far
The alert was serious, but BitBox did not report an ongoing hack. The company said it had not received any reports indicating that the boot loader or memory corruption vulnerability had been exploited. The third issue has also been fixed, involving silent payments. Unlike the first two vulnerabilities, it does not directly lead to the theft of funds, but may prevent payments to unintended addresses and, according to BitBox, may create scenarios that favor extortion requests.
This incident mainly reminds us that hardware wallets do not become invulnerable because keys remain offline. Embedded software remains an important part of security. For affected users, the steps are still simple: open BitBoxApp, verify the firmware version, and then install the updates provided from the official app, and never share mnemonics.
Finally, asset protection depends not only on the choice of hardware wallet, but also on its use and timely updates.
