On August 17, the manufacturer of hardware wallets, BitBox, released the Dixence update, which fixed two serious vulnerabilities in the devices’ firmware. The errors were discovered during internal audits using artificial intelligence models. The company emphasized that it had not recorded any instances of the vulnerabilities being exploited or users’ funds being stolen, and the wallet owners’ seed phrases were also not affected.

The first issue affected the BitBox02 bootloader – the component responsible for installing the firmware. The error itself was fixed back in the July version 9.26.2, but later the developers found out that the potential attack would have been more dangerous than initially thought. To exploit it, an attacker would first need to carry out a successful phishing attack, for example, convince the user to install a fake version of BitBoxApp along with malicious firmware, and then unlock the device. After that, the attacker could install modified software on the real BitBox02 and gain the ability to steal funds. The new BitBox02 Nova model is not susceptible to this attack due to a different version of the bootloader.. The second serious vulnerability is related to memory corruption in the Multi version. It manifested on a device where the wallet had not yet been configured, when connected to a malicious computer. The error allowed arbitrary code to be executed and potentially installed modified firmware. It was fixed in Dixence version 9.26.5. During the same checks, engineers found another issue in the Silent Payments function. It did not allow coins to be stolen directly, but an attacker could lock them in the wrong address and then demand a ransom to restore access. This bug was also fixed in version 9.26.5.

BitBox developers noted that they had conducted an in‑depth review of the entire codebase over the past few weeks. The company also received a record number of reports from third‑party auditors, most of whom used modern artificial intelligence models to search for errors. These external checks have not yet identified any critical or serious vulnerabilities. Version 9.26.5 addresses all three described issues. BitBox recommends that all users install it, and before doing so, be sure to familiarize yourself with which older firmware versions are affected: BitBox02 with a version up to 9.26.1 – when a malicious application and firmware are installed; BitBox02 and BitBox02 Nova Multi with versions up to 9.26.4 – if the wallet has not yet been configured and the device is connected to a malicious computer; BitBox02 and BitBox02 Nova with versions from 9.21.0 to 9.26.4 – when using Silent Payments together with a malicious device. The update should be carried out via the already installed BitBoxApp or the official website.