BitBox Patches Code Execution and Bitcoin Lockup Flaws | Crypto ETF News
Crypto ETF news: BitBox Patches Code Execution and Bitcoin Lockup Flaws. This update explains what changed, why it matters for institutional adoption, market flows, and investor sentiment, and what the crypto market should watch next.
Institutional And ETF Update
Hardware wallet maker BitBox has released a firmware update that fixes two vulnerabilities it described as “severe” that could have enabled the installation of malicious firmware or put user funds at risk. In a security disclosure on Monday, BitBox said one involved memory corruption affecting Multi editions of BitBox02 and BitBox02 Nova that had not been configured with a wallet. A malicious host could exploit it to execute arbitrary code and potentially install malicious firmware, which could lead to lost funds. The second affected BitBox’s Silent Payments implementation and could have allowed a malicious host to lock Bitcoin to an unintended address. Direct theft was not possible, but an attacker could potentially demand a ransom to cooperate in recovering the coins, according to BitBox. The company said it had received no reports of either vulnerability being exploited or causing users to lose funds. The disclosure comes at a sensitive moment for self-custody, after a Coldcard firmware flaw was linked to more than $112 million in Bitcoin thefts, underscoring how weaknesses in devices designed to protect private keys can become points of failure.Cointelegraph reached out to BitBox for more information but did not receive a response before publication. BitBox patch follows Coldcard thefts, wallet data leaksThe BitBox security update follows a wave of hardware-wallet incidents involving devices and the services surrounding them. The most damaging was the Coldcard flaw, which traced to a March 2021 firmware change that went undetected for more than five years. The vulnerability affected wallet-seed randomness, allowing attackers to brute-force impacted wallet seeds and derive their private keys without physical access. Galaxy Research said Friday that Coldcard-related losses had exceeded $112 million, with about 1,778.6 BTC swept from more than 8,600 addresses.Related: Coldcard exploit pushes July losses to $247M as second-worst month of 2026More recently, separate data breaches involving Trezor and SafePal exposed customer and order information belonging to more than 53,000 customers. Trezor attributed the exposure of 13,689 customers’ data to shipping provider ShipMonk, while SafePal said an authorization flaw in an order-tracking plug-in exposed details belonging to 39,798 customers.Neither incident compromised devices, private keys or recovery phrases, but both companies warned that the information could enable targeted phishing and impersonation attacks. Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?
Why This ETF News Matters
First, this development may affect institutional demand, exchange flows, market liquidity, and broader investor confidence. In addition, it may influence custody trends, fund positioning, and future crypto product approvals. As a result, traders and investors should watch the next moves closely.
What To Watch Next
Watch for filing updates, approval decisions, inflow and outflow data, custody changes, and asset manager commentary. In particular, any new developments involving BlackRock, Grayscale, Fidelity, or major spot ETF products could directly affect the broader crypto market.
