BitBox fixes severe wallet firmware flaws found during AI-assisted audits
Firmware version 9.26.5 addresses memory corruption and silent-payment issues, while an earlier bootloader flaw was fixed in July.
Add us on Google
Aug. 18, 2026
BitBox has released firmware version 9.26.5 to fix two severe vulnerabilities and a silent-payment flaw found during internal security reviews that included frontier AI models.
The company said it had no reports that any of the issues were exploited, no user funds were known to have been stolen and wallet seeds were unaffected.
One previously fixed bootloader vulnerability could have allowed an attacker to install malicious firmware on an authentic BitBox02 after first tricking a user into installing a fake BitBoxApp and unlocking the device. BitBox fixed that issue in firmware version 9.26.2.
BitBox02 Nova devices were not affected by the bootloader flaw because they use a newer bootloader version.
A separate memory-corruption vulnerability affected Multi-edition devices that had not yet been set up with a wallet and were connected to a malicious host. It could have enabled arbitrary code execution and malicious firmware installation. <a href="https://cryptoz7.com/hives-350m-ai-cloud-deal-a-closer-look-at-<a href="https://cryptoz7.com/bitcoin-is-down-44-and-its-miners-are-up-90-the-ai-pivot-explains-everything/” title=”Bitcoin Is Down 44% and Its Miners Are Up 90%. The AI Pivot Explains Everything.”>bitcoin-minings-big-ai-pivot/” title=”HIVE's $350M AI cloud deal: A closer look at bitcoin mining's big AI pivot”>Bitcoin-only editions were not affected.
The silent-payment flaw could have directed funds to an unintended address and enabled a ransom attempt, though it did not permit direct theft. Firmware version 9.26.5 fixes both that issue and the memory flaw.
BitBox advised all users to install the latest BitBoxApp from its official website and update their device firmware.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
