bitbox

BitBox used frontier AI models during an internal firmware review that uncovered vulnerabilities capable of enabling malicious firmware or locking Bitcoin to an unintended address.The company said it found no evidence of exploitation or fund losses and is urging users to install firmware version 9.26.5.
News - BitBox’s latest security scare came from inside its own audit process. The hardware-wallet maker said AI-assisted testing helped uncover firmware weaknesses before there was evidence attackers had used them.
The Dixence update, version 9.26.5, now patches the disclosed issues, but the routes to exploitation differed sharply.
One path needed a hostile host - A memory-corruption flaw affected unconfigured Multi editions of the BitBox02 and BitBox02 Nova. A malicious connected computer could potentially execute arbitrary code and install hostile firmware, creating a path to later compromise funds. The Bitcoin-only edition did not contain the affected code.
Another could trap, not steal - A flaw in BitBox’s Silent Payments implementation could cause Bitcoin to be locked to an unintended address. BitBox said it could not directly transfer the coins to an attacker, although the attacker could potentially demand a ransom to help recover access.
The bootloader had its own warning - BitBox also disclosed that an earlier bootloader issue was more serious than initially reported. Under a phishing scenario involving a fake BitBoxApp and an unlocked device, an attacker could have installed malicious firmware on a genuine BitBox02. The newer BitBox02 Nova was not exposed to that bootloader issue.
BitBox said no user funds were reported stolen through these flaws. Older affected firmware, however, remains exposed until users install the fixes.
$BTC
$ETH
$BNB
#bitbox