BitBox firmware vulnerability fixed as Coldcard’s flaw drains $115M in bitcoin
A Swiss hardware wallet maker just gave the Bitcoin community a rare piece of good security news, and the timing could not be more pointed. BitBox disclosed and patched a BitBox firmware vulnerability that could have let an attacker trick users into installing malicious firmware and draining their funds, but the company says it caught the flaw before anyone lost a single satoshi. The disclosure lands just weeks after a similar-sounding firmware flaw in rival wallet Coldcard turned into one of the largest hardware wallet thefts on record.
Key takeaways
- BitBox patched a severe firmware vulnerability that could have allowed attackers to push malicious firmware and steal funds, but reports no user funds were stolen.
- The flaw affected only the Multi edition of the BitBox wallet; the Bitcoin-only edition was not affected.
- BitBox users only need to update their firmware through the official BitBoxApp, not migrate funds to new wallets.
- Coldcard’s Coinkite faced a much bigger crisis, with a firmware bug tracing back to March 2021 blamed for more than $115 million in stolen bitcoin, according to Galaxy Research.
- According to Decrypt, BitBox credited AI-assisted testing with surfacing the vulnerabilities before they could be exploited.
BitBox patches severe firmware vulnerability
BitBox says it found and fixed two “severe vulnerabilities” in its hardware wallet firmware before attackers could use them against real users. The Swiss company laid out the details in a blog post published Tuesday, walking through exactly what went wrong and why customers shouldn’t panic.
… Continue reading the full article at the original source below.
