The Dixence update brings firmware to version 9.26.5 and closes two flaws that could enable arbitrary code execution or lock funds sent with Silent Payments. BitBox reports no exploitation or stolen funds.
BitBox has released the Dixence update, bringing its firmware to version 9.26.5 and fixing two severe vulnerabilities found during internal audits. In its security bulletin, the company says it has received no reports of exploitation or stolen funds and that existing wallet seeds are not affected.
The bulletin also updates the assessment of a bootloader flaw already fixed in July with firmware 9.26.2. On a BitBox02 running version 9.26.1 or earlier, an attacker could have manipulated a user into installing malicious firmware on a genuine device. The attack first required successful phishing, for example through a fake BitBoxApp, followed by the victim unlocking the device. The BitBox02 Nova is not affected by this flaw.
The first vulnerability fixed by Dixence is a memory corruption issue in the Multi edition. It applies when no wallet has yet been set up on the device and the hardware is connected to a malicious host. According to BitBox, exploitation could allow arbitrary code execution and the installation of manipulated firmware, potentially leading to a loss of funds. The Bitcoin-only edition does not contain the affected code.
The second flaw concerns Silent Payments. A malicious host could have locked funds to an unintended address while a transaction was being created. BitBox rules out direct theft but describes a potential ransom scenario, since recovering the coins would require cooperation between the attacker and the recipient. Devices running firmware from 9.21.0 through 9.26.4 may be affected.
BitBox recommends that every user update to firmware 9.26.5 through the official BitBoxApp. The safest route is to use the update banner or version number shown inside the already installed app, avoiding search results and links received by email. It is the same precaution made necessary by counterfeit apps impersonating hardware wallet manufacturers.
Recent audits included testing with frontier AI models. BitBox says none of the external researchers who examined its code with these tools has so far reported a critical or severe issue; the two vulnerabilities addressed by Dixence were found by the internal team. After updating the firmware, users do not need to migrate their wallet seed or enter their recovery words into an application or website.
