Dogecoin Advocate Warns Bitcoin Holders of a Serious Security Threat

BitBox released a security update yesterday for its BitBox02 wallets. Named Dixence, the patch addresses several vulnerabilities, including two considered severe. The next day, Dogecoin contributor Mishaboar relayed the alert and urged affected bitcoin holders to check their firmware without delay. 

BitBox02, several firmware versions are affected

BitBox02 is a hardware wallet that stores private keys in a device separate from the phone or computer. The presentation page of the BitBox02 already tested by Cointribune helps to position the product, but the issue as of August 17th is now software-related: BitBox recommends the latest version of its firmware.

The first flaw concerns the bootloader, the program responsible for launching the firmware at startup. According to the security bulletin published by BitBox, an attacker could, under certain conditions, lead a user to install malicious firmware through a fake BitBox app. Once the device was unlocked, the funds could then be at risk.

This issue had already been fixed in Oeschinen 9.26.2. BitBox also clarifies that the BitBox02 Nova is not affected by this attack, which is linked to older bootloader versions. To date, the company states it has not detected any exploitation cases.

The second severe vulnerability affects the Multi edition. It could appear when a device not yet configured communicated with a compromised computer. A memory corruption could then allow code execution and, in the worst-case scenario, installation of malicious firmware.

The Bitcoin-only edition is not affected by this part of the issue.

We strongly recommend updating to the latest firmware version in all cases to benefit from all security improvements.

The update must be done through BitBoxApp

There is no question here of downloading a firmware file sent by email, messaging, or social network. According to the official BitBox guide, the update is distributed directly through BitBoxApp.

You must first install the latest version of the app from the official site, connect the wallet, unlock it, then go to “Settings” and “Manage device.” The update must then be confirmed directly on the BitBox02.

A red dot appears in the app when a new version is available. BitBox also asks users not to disconnect the device during installation.

Today, Mishaboar relayed the alert on X, urging BitBox users to update their devices quickly. As reported by U.Today, he also advises performing the operation from a clean, even freshly installed computer when possible.

This last precaution comes from Mishaboar. BitBox, for its part, mainly emphasizes using the official app and warns about phishing risks.

No confirmed exploitation so far

The alert is serious, but BitBox does not report ongoing hacks. The company states it has received no reports indicating that the bootloader or memory corruption vulnerabilities have already been exploited.

A third issue was also fixed. It concerns silent payments. Unlike the two previous vulnerabilities, it did not directly allow theft of funds. However, it could block a payment to an address different from the expected one and, according to BitBox, create a scenario favorable to a ransom request.

The matter mainly reminds us that a hardware wallet does not become invulnerable just because keys remain offline. The embedded software remains an essential component of security. The recent Cointribune report on Coldcard had already illustrated this, although the two situations are different. In BitBox’s case, no theft related to the announced vulnerabilities has been confirmed.

For affected users, the procedure remains simple: open BitBoxApp, verify the firmware version, and install the update offered from the official app, never sharing recovery words.

Our guide dedicated to crypto security finally reminds that asset protection depends not only on choosing a hardware wallet but also on how it is used and kept up to date.