BitBox02 9.26.5: The Three-Trigger Triage You Can Run Tonight

BitBox02 9.26.5: The Three-Trigger Triage You Can Run Tonight

Open BitBoxApp and read the firmware version in the device settings. If it shows 9.26.5, half of tonight's checklist is already done. If it reads anything older, update — but read the rest of this before you touch your seed or move a single coin. "Critical vulnerability" and "your funds are at risk" are being merged by headline writers, and the gap between those two sentences is where the follow-up phishing wave sits.

Here is the situation in one screen-load. Earlier this week, Swiss maker Shift Crypto pushed firmware 9.26.5 — codenamed Dixence — to its BitBox02 and BitBox02 Nova hardware wallets. The company says the flaws were found by its own internal audit assisted by AI tooling. Public CVE identifiers have not been assigned yet, and no exploitation has been reported. That sets the confidence level: this is a vendor-reported clean bill until independent evidence says otherwise. What the disclosure does give you is precise trigger conditions, and those trigger conditions are the whole game.

Three flaws, three triggers.

Flaw	Touches	Trigger	What it does
Memory corruption	BitBox02 Multi and Nova, only before wallet setup	Unconfigured device plugged into a compromised computer	Lets a malicious host run arbitrary code and install malicious firmware before a seed is ever created
Silent Payments routing	Anyone who used Silent Payments on firmware 9.21.0 through 9.26.4	Sending to a silent payment address while a malicious host controls the session	Routes the payment to the wrong address; the coins get locked, not stolen
Bootloader phishing	BitBox02 Bitcoin-only and Multi; Nova is not affected	Successful phishing: fake BitBoxApp, then malicious firmware, then device unlock	Malicious firmware that can later drain the wallet

Now the mechanism that decides whether each row describes you.

The memory-corruption row carries the top severity label, and it is also the narrowest. It only fires while the device is unconfigured — the window between opening a new box and creating your first wallet, which is exactly when a compromised computer can stand between you and the device. A hardware wallet's job before setup is to generate the seed inside the secure chip and keep it there; if an attacker gets code running in that pre-seed window, they install malicious firmware and the seed you create later is born into a trap. That is why the Bitcoin-only edition of the BitBox02 is absent from the affected list: it does not contain the vulnerable code. It is also why your configured device is not exposed: firmware is signature-checked at boot, so an attacker who shows up after your seed exists cannot quietly swap the operating system.

The Silent Payments row is the one that turns this wallet story into an on-chain story. Silent Payments is a Bitcoin privacy feature that lets a sender pay toward you without a reusable address linking your history together, and without you sitting online to receive. The bug let a malicious host steer a payment toward the wrong address. Nobody could withdraw your bitcoin through it; they could only make it land somewhere you cannot reach, then offer to "help" you recover it for a ransom. That is why the highest-value verifiable check this advisory contains is a receipt audit, not another firmware number.

The bootloader row is the one that demands the least technical skill and the most caution. It is a bootloader flaw patched earlier this year in the Oeschinen update (9.26.2), which only partially addressed it, and BitBox re-ranked it as more severe than initially assessed; firmware 9.26.5 is the closing patch. The exploit chain only completes if phishing succeeds first: you install a fake BitBoxApp, let it load manipulated firmware, then unlock the device. The Nova's bootloader is built differently and is not reachable by this path.

What to check now: the runbook.

1. Confirm model and version. In BitBoxApp, open device settings. Bitcoin-only model: the memory-corruption row is blank for you. Nova: the bootloader row is blank. Everyone: the firmware line should read 9.26.5.

2. Chase the app, not a link. Download BitBoxApp from bitbox.swiss only, and verify its signature before you grant it USB access. A security announcement is permission marketing for scammers; the bootloader attack chain opens with a fake app.

3. Flash and stay wired. Run the update inside the official app, keep the device plugged in through the whole install, then re-check that version line. Dogecoin contributor Mishaboar, who relayed the alert widely, suggested updating from a clean, freshly installed computer if you have one handy.

4. Audit Silent Payments receipts — the only on-chain check on this list. If you used Silent Payments on firmware 9.21.0 through 9.26.4, confirm that funds received in that window landed at the addresses you generated, before you send more on top. The routing history lives on the chain, not inside the wallet, so this check stays runnable after you update.

5. Do not react to the panic. No seed re-roll, no recovery words typed into any website, browser extension, support chat, or "verification" form, no forced migration to a fresh device out of fear. BitBox states the disclosed flaws never touched the seed-generation step and that existing seeds remain valid. The most expensive thing this advisory can cause is a self-inflicted migration that a headline talked you into.

Where the confidence is honest and where it is thin.

The checks above are the parts you can verify inside one session: your version number, your app provenance, your receipts. The parts you cannot verify are exactly where you should keep your conviction soft. The AI-audit story and the clean bill of health are BitBox's own claims, no independent severity scores exist yet, and Cointelegraph reported that BitBox did not respond to requests for further information prior to publication. Grade severity yourself when the CVE entries land, and treat "no exploitation detected" as a statement of absence — encouraging, and not a guarantee.

The expiry clause.

Hardware-wallet firmware just became a dated input, and that is the observation that outlives this advisory. Two weeks before this disclosure, BitBox's own engineering blog said its most recent release fixed "a whole batch of bugs" surfaced by researchers and internal audits using AI tools. Translate that cadence: AI-assisted audit means the shelf life of "current firmware" is measured in weeks, so the reversal that retires tonight's urgency is a routine, not a panic — open the app, read the version, and whenever the number changes, rerun steps 2 through 4. And keep the benchmark for the real damage class in view: pre-seed compromise. The canonical case is the Coldcard firmware flaw tied to over $112 million in bitcoin stolen through weak randomness in the seed-generation step. That is why a closed pre-seed code-execution path earns more than a shrug even with zero funds reported missing. Your move tonight is to update, verify receipts, and leave the seed exactly where it is. The method stops being urgent the day your version counter reads 9.26.5 and your routing history is clean — and it will be replaced by the next timestamp, because there will be one.