BitBox02

Is the BitBox02 safe?

Yes. The BitBox02 is a small USB hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary from Shift Crypto in Switzerland that keeps your keys on the device, publishes every line of its firmware and lets anyone rebuild the release from source. No funds have been reported stolen through one since it launched in 2019. We score it 83/100, a B.

The catch is 2026. BitBox disclosed three severe firmware bugs in July and August, all fixed and none reported exploited, and in September attackers sent phishing emails from its own newsletter account. Neither touched existing seeds, but both are reasons to keep the firmware current and distrust any email about your recovery words.

The 2026 firmware bugs

Fixed in	Issue	Who could be hit
9.26.2 (July)	Out-of-bounds write over USB in firmware and bootloader, reported by a CertiK researcher; BitBox later rated it severe	BitBox02 through 9.26.1, if a user installed a fake BitBoxApp carrying malicious firmware; Nova not affected
9.26.5 (August)	Memory corruption before a wallet is set up	Multi edition with a malicious computer; Bitcoin-only not affected
9.26.5 (August)	Silent payments could send coins to an address the attacker controls jointly with the recipient	Users paying a silent-payment address from a malicious computer

BitBox found the second and third issues itself, partly with frontier AI models, and its engineers had also found the bootloader exploit before an external researcher from SySS reported it. The company published each bug with affected versions and said there were "no reports of stolen user funds". That is how disclosure should work. Still, the bootloader flaw could have let a convincing phishing campaign turn a genuine device against its owner, so the security record sits at 78, level with Trezor, rather than higher.

When BitBox's own newsletter sent phishing

On 10 September 2026 attackers exploited a single sign-on flaw at Brevo, BitBox's newsletter provider, took over its account and sent two phishing campaigns. The emails falsely claimed a security flaw in the BitBox and linked to a site asking for recovery words. Because they went out through BitBox's real account, they passed the usual email checks. BitBox warned subscribers within the hour and had the phishing domains taken down within minutes. The attackers also downloaded the contact list, which BitBox says held email addresses only. Trezor's newsletter was abused through Brevo in the same week.

BitBox has not said whether anyone lost coins. Its shop runs on its own servers and order data is anonymised after 30 days, so unlike the Ledger and Trezor leaks, no home addresses were exposed. Company record scores 78.

How the BitBox02 protects your keys

Keys are generated on the device and never leave it. The seed is stored encrypted on the microcontroller, and decrypting it needs three secrets: one on the secure chip (an ATECC608B on the BitBox02, an Optiga Trust M V3 on the Nova), one on the microcontroller and your device password. The secure chip also caps password guesses.

Seed generation is where the Coldcard failure made every hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary look again. BitBox combines five sources: random generators on the secure chip and the microcontroller, a unique value set at the factory, randomness from the computer running the BitBoxApp, and a hash of your password. One weak source cannot make the result guessable. BitBox says an internal review after the Coldcard thefts confirmed the code works as described; we found no recent outside audit focused on it.

You get a standard 12-, 18- or 24-word backup or a microSD backup, an optional passphrase and multisigMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary. Anti-klepto, for which BitBox wrote the original pull request to Bitcoin Core's secp256k1 library, stops a malicious app from hiding your key in signatures. The device always connects by cable rather than signing offline, which keeps key security at 88 rather than 90.

One new feature does not get this protection. Since 15 September 2026 the mobile BitBoxApp has offered a Lightning wallet in public beta. Its keys are derived from your BitBox seed (BIP-85), so your existing backup restores it, but they are stored on your phone and payments are signed there: BitBox itself calls it a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary. It runs on the Breez SDK with Spark, whose operators must cooperate for you to move funds until a promised unilateral exit arrives. Our score covers the hardware wallet, not this Lightning balance; keep only spending money in it.

Open source you can rebuild

Both the firmware and the BitBoxApp are on GitHub under Apache 2.0, a true open-source licence, and the repo includes instructions to reproduce the official firmware byte for byte. WalletScrutiny's current verdict for the BitBox02 reads "source available"; BitBox points to WalletScrutiny's build tests. Census Labs audited the firmware, and the bug bounty pays by severity, though without published amounts. Transparency scores 85.

What you see before you sign

For bitcoin, the BitBox02 shows each recipient address and amount on its own screen. On Ethereum it decodes plain token transfers, but for unknown contracts it warns you and then shows raw transaction data, which few people can read. There is no simulation. Scam protection scores 82; if you only need bitcoin, the Bitcoin-only edition avoids most of this.

How to stay safe with a BitBox02

1. Buy from bitbox.swiss or an official reseller and check the tamper-evident bag.
2. Update to firmware 9.26.5 or later from inside the BitBoxApp.
3. Choose the Bitcoin-only edition if bitcoin is all you hold.
4. Write the backup on paper or metal; never type it into a website, app or email reply, even one from BitBox's real address.
5. Check every address on the device's screen, and reject unknown contract calls you cannot read.

How we scored it

Key security (88) and transparency (85) are the BitBox02's strengths: keys behind a secure chip, five entropy sources and fully open, reproducible firmware. Security record (78) and company record (78) are the weakest, because of the 2026 firmware bugs and phishing sent through its newsletter account, even though no losses are known. It scores level with Trezor and well above Coldcard, whose seed bug was exploited.