Bitcoin Magazine

BitBox Warns Bitcoiners After Discovering ‘Severe’ Vulnerability In Firmware 

Bitcoin wallet manufacturer BitBox has told users it was able to fix “severe vulnerabilities” with its hardware wallet’s firmware, and reassured users that no funds were taken. Yet it still urged users to upgrade carefully. 

Writing in a blog post Tuesday, the Swiss company said that one of the vulnerabilities would have allowed an attacker to manipulate users into installing firmware that could lead a criminal to steal funds. 

Users should update firmware through the official BitBoxApp, ideally by clicking the in-app update prompt rather than searching for it, BitBox said. 

“There are no reports of stolen user funds and there is no reason for users to panic,” the company said. “We recommend all users to update their BitBox devices to the latest firmware version, which fixes all security issues described in this article.”

It added that another “severe vulnerability” discovered was related to memory corruption. In its post, BitBox said the finding was related to the Multi edition of the BitBox, and could enable arbitrary code execution and the subsequent installation of malicious firmware and potential loss of funds. 

BitBox also mentioned that the Bitcoin-only edition of the BitBox was not affected, as its firmware does not contain the affected code. 

Bitcoiners are still reeling after users of the popular Coldcard product, designed by Canadian company Coinkite, had their funds drained due to a firmware bug in the devices that lead to a weak seed generation (RNG). Unlike the Coldcard hack, users or BitBox do not need to migrate funds, only update the firmware. 

Hackers have since stolen a confirmed $115 million in bitcoin, according to Galaxy Research’s latest figures — but the figure could be much higher. 

Canadian company Coinkite first warned users on July 31 that a firmware bug in Coldcard Mk3 devices — starting with version 4.0.1 in March 2021 — caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator, allowing hackers to essentially guess investor seedphrases. 

The number has slowly risen as the criminals have targeted more recent devices while Coinkite and other Bitcoiners have urged Coldcard users to immediately move their funds.

This post BitBox Warns Bitcoiners After Discovering ‘Severe’ Vulnerability In Firmware  first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Coldcard Bitcoin Thief Likely Used Top Blockchain Services Provider: Report

Since over $70 million in Bitcoin was stolen yesterday by an attack that exploited a fault in the Coldcard’s system, it has been reported that the thief used a top blockchain services provider for help. 

Writing on X Friday, engineer at payments company Block, Clay Garrett, said that the provider — who he did not name at the request of the services provider — had been contacted after finding blockchain movements matched the “suspected workflow” of the attacker. 

“During our investigation of the Coldcard drain yesterday, we identified an unusual pattern in the sweeps,” Garrett said. 

“That pattern led us to a hypothesis that has since been confirmed: the operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity during the sweeps,” Garrett continued, adding that the authorities had been notified. 

Galaxy Digital’s research arm also wrote on X that the thief had an unusual pattern of moving the coins. 

“The pattern tells us these were all the same attacker — it does not capture the attack itself, which looks the same as if a coin owner chose to move coins,” the company said, adding that Bitcoiners should move funds out of single-signature Coldcard addresses and into secure custody.

After over $35 million in Bitcoin was drained from wallets on Thursday, Coinkite said that a firmware bug in Coldcard Mk3 devices — starting with version 4.0.1 in March 2021 — caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator. 

This allowed private keys for many single-signature wallets (especially those created without dice rolls or a strong BIP-39 passphrase) predictable enough for attackers to brute-force.

Later on Friday, Coinkite admitted all of its models were vulnerable following more thefts. Over $70 million has so far been swiped and engineers have warned that more Bitcoin addresses could be at risk. 

The company makes a number of Bitcoin products, including cold storage hardware wallets.

This post Coldcard Bitcoin Thief Likely Used Top Blockchain Services Provider: Report first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.