BitBox, a hardware wallet manufacturer has issued a firmware upgrade that addresses two security vulnerabilities. “severe” It could also have put the user’s funds or security at risk.
BitBox released a statement on security Monday. said The first involved memory corruption in Multi editions BitBox02 Nova and BitBox02 that were not configured with wallets. It could be exploited by a malicious host to run arbitrary code or install malicious firmware. This could result in lost funds.
Second, BitBox’s Silent Payments could have been abused by a malicious host in order to lock Bitcoin into an unintended destination. BitBox says that although direct theft is not possible, an attacker may demand ransom in order to recover coins. According to BitBox, the company has not received any reports that a vulnerability was exploited by an attacker or caused users’ funds to be lost.
This disclosure is timely, as a Coldcard software flaw has been linked to thefts of more than $112,000,000 in Bitcoin. It highlights how devices that are designed to secure private keys may fail.
Cointelegraph contacted BitBox to get more information, but received no response prior to publication.
BitBox patches follows coldcard thefts and wallet data leaks
BitBox has released a security update following a spate of hardware wallet incidents.
Coldcard, the flaw that was most harmful to users. traced to a March 2021 firmware change This vulnerability was undetected by the security community for over five years. This vulnerability affects wallet seed randomness. It allows attackers to use brute force on wallet seeds in order to derive private keys, even without having physical access.
Galaxy Research said Coldcard related losses exceeded $112,000,000 on Friday, as 1,778.6 BTC were snatched from over 8,600 addresses.
Related: Coldcard exploit pushes July losses to $247M as second-worst month of 2026
Recent developments in the field of linguistics separate data breaches Trezor and SafePal both exposed information about customers and orders belonging to over 53,000 clients. Trezor has attributed exposure of 13 689 customer data to ShipMonk while SafePal claims an authorization problem in order-tracking plugin exposed information belonging to 39 798 customers.
Both companies have warned of the potential for targeted impersonation and phishing attacks.
Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: cointelegraph.com
