AI-Driven Review Unveils Severe Flaws in BitBox Firmware

BitBox, a Zurich-based company behind the BitBox02 cryptocurrency wallet, has disclosed two severe flaws in its firmware after using AI to review its code. The issues were found internally and have been fixed with the release of the Dixence security update. The first problem resided in the bootloader, which could have allowed an attacker to load malicious firmware onto a genuine BitBox02 if a user installed a fake app and unlocked their device.

The second flaw was a memory-corruption issue in the Multi edition of the BitBox before it's been set up with a wallet. This could have allowed arbitrary code execution, potentially leading to malicious firmware installation. However, the Bitcoin-only edition was not affected by this issue. A third, less severe problem related to the silent-payment feature has also been fixed.

BitBox used frontier AI models as part of its internal review process, which is a growing trend in auditing firmware for security vulnerabilities. The company emphasized that there's no evidence users' funds have been stolen and reassured them not to panic.