BitBox02 firmware flaws could let attackers install malicious firmware

August 17, 2026BitBoxHigh

Who is affected

BitBox02 owners on older firmware could have malicious firmware installed after being phished into using a fake app, and un-set-up Multi devices were exposed to a malicious computer. BitBox reports no exploitation or stolen funds and states seeds were not affected.

What happened

On 17 August 2026 BitBox released its “Dixence” update, firmware 9.26.5, and disclosed three issues found in internal audits that, BitBox says, included testing with frontier AI models.

The first is in the BitBox02 bootloader, which controls what firmware the device accepts. According to the reports, an attacker who had phished a user into installing a fake BitBoxApp and unlocking the device could load malicious firmware onto a genuine BitBox02. BitBox states it was already fixed in the July 2026 “Oeschinen” release, firmware 9.26.2, and is more severe than first reported. It was found internally and later reported independently by Jan Wütherich of SySS GmbH. BitBox says the BitBox02 Nova is not affected because of the age of the bootloader versions involved, and that the attack also requires high technical skill. Separately, DailyCoin reports that BitBox’s July update fixed an out-of-bounds write in USB request handling reported by CertiK researcher Guanxing Wen, which BitBox said could allow control-flow hijacking.

The second is a memory-corruption flaw in the Multi edition of BitBox02 and BitBox02 Nova before a wallet is set up: connected to a malicious computer, it could allow arbitrary code execution and the installation of altered firmware. The Bitcoin-only edition does not contain the affected code. The third, in Silent Payments on firmware 9.21.0 to 9.26.4, could not be used to steal coins directly, but a malicious host could send funds to an unintended address and demand a ransom.

BitBox states that existing wallet seeds are not affected, that it has no reports of any of the issues being exploited or of stolen funds, and that devices on firmware 9.26.5 or later are not affected. According to BitBox, the bootloader issue affects BitBox02 firmware up to and including 9.26.1 (ForkLog reported “before 9.26.1”).

What BitBox advises:

Update the BitBoxApp and then the device firmware under Manage device.
Download the app only from bitbox.swiss or via the update banner inside the BitBoxApp.
Never enter the recovery words anywhere other than on the BitBox itself.

Sources

Independent reporting and research this entry was checked against.

Learn more

Guides on protecting yourself against this type of incident (Firmware vulnerability) and the glossary terms that describe it.

Can Hardware Wallets Be Hacked?

Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.

Read Guide

Is a Hardware Wallet Really Safe?

Hardware wallets are the safest option for most people — but you can still make mistakes. Here's what to know.

Read Guide

Firmware

Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.

Bootloader

A bootloader is a small program that initializes hardware and loads the main operating system or firmware on a device, often used in blockchain hardware wallets for secure startup.

Firmware Update

Firmware Update installs new low-level software on a hardware wallet to fix bugs, enhance security, or add features in cryptocurrency devices.

Cite this entry

WalletInsights. “BitBox02 firmware flaws could let attackers install malicious firmware”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/bitbox02-dixence-firmware-flaws-2026/

Corrections and right of reply

Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.

All incidents All BitBox incidents