BitBox has released a firmware update fixing two severe vulnerabilities that could have exposed hardware wallet users to malicious firmware or caused Bitcoin to be locked to an unintended address.

BitBox said in a security disclosure on Monday that the first vulnerability involved memory corruption affecting unconfigured Multi editions of the BitBox02 and BitBox02 Nova, while a second flaw affected the wallet maker’s Silent Payments implementation.

The company said it had found no evidence that either vulnerability had been exploited and had received no reports of users losing funds because of the flaws.

BitBox vulnerability could have allowed malicious firmware

For the first vulnerability, BitBox said a malicious host connected to an affected wallet could exploit memory corruption to execute arbitrary code before the device had been configured with a wallet.

Successful exploitation could potentially allow the host to install malicious firmware, creating a route through which funds could later be compromised, according to the company.

The exposure was limited to Multi editions of the BitBox02 and BitBox02 Nova that had not yet been set up. BitBox classified the vulnerability as severe because arbitrary code execution could undermine protections designed to prevent unauthorised software from running on the hardware wallet.

Firmware controls how a hardware wallet handles cryptographic operations, verifies transactions and communicates with a connected computer. BitBox said the vulnerability could therefore put funds at risk if an attacker managed to use the flaw to install malicious firmware on an affected device.

Similar hardware and firmware weaknesses have surfaced at other wallet makers in recent months. In June, crypto.news reported on a flaw in the TROPIC01 Secure Element used by Trezor Safe 7 devices after Ledger Donjon researchers carried out a laser fault injection attack during laboratory testing.

Trezor said its Safe 7 remained protected because the device uses three independent hardware security layers. According to the company, compromising TROPIC01 alone did not provide access to a user’s PIN, wallet or funds.

Tropic Square had provided the chip to Ledger Donjon for independent testing, with researchers notifying the company in January that they had extracted some chip secrets and bypassed firmware signature checks using the laboratory attack.

Another hardware attack disclosed in July allowed Ledger Donjon researchers to reset the password on a Tangem wallet card using a targeted laser pulse against its secure element.

Ledger Donjon said the attack required physical possession of the card, invasive preparation, specialist knowledge and laboratory equipment costing about $250,000. Tangem described the everyday risk to customers as “virtually non-existent,” while advising users to keep their wallet cards physically secure.

Silent Payments flaw could have locked Bitcoin

BitBox’s second severe vulnerability affected Silent Payments, a Bitcoin privacy feature that allows users to receive payments without publishing a new address for each transaction.

According to BitBox, a malicious host could exploit the implementation to cause Bitcoin to be locked to an unintended address.

Direct theft was not possible through the vulnerability, the company said. An attacker could instead leave the victim unable to recover the Bitcoin without cooperation and potentially demand a ransom in exchange for helping unlock the coins.

Such an attack would not automatically transfer control of the affected Bitcoin to the malicious host, but BitBox said the vulnerability could still put funds at risk by making them inaccessible to their owner.

The company addressed the problem through its latest firmware update and said it had received no reports of the Silent Payments flaw being exploited.

BitBox has dealt with other security issues through firmware updates this year. Its Oeschinen update in July included several security fixes, including one for a buffer out-of-bounds write affecting the BitBox02 firmware and bootloader.

According to the company’s disclosure at the time, a USB request accepted a length value without properly checking it against the size of the destination buffer, creating a potential route for a malicious host to trigger an out-of-bounds write.

BitBox said no working exploit had been demonstrated for that vulnerability, although an effect on control flow could not be completely ruled out.

Earlier in January, the company also patched two BitBox02 Nova vulnerabilities reported through its bug bounty programme. BitBox classified the issues as minor and moderate because exploitation required advanced physical access and applied only under specific conditions.

Coldcard firmware flaw has put wallet security under scrutiny

BitBox’s update follows the disclosure of a separate Coldcard firmware flaw linked to more than $112 million in stolen Bitcoin after the vulnerability remained undetected for more than five years.

Galaxy Research said Friday that Coldcard-related losses had exceeded $112 million, with approximately 1,778.6 BTC swept from more than 8,600 addresses.

The vulnerability was traced to a firmware change introduced in March 2021 that affected the randomness used to generate wallet seeds. Attackers could brute-force impacted seeds and derive the corresponding private keys without obtaining physical access to the hardware wallet, according to research into the incident.

A wallet seed is used to derive the private keys controlling its cryptocurrency. Weaknesses that reduce the randomness used during seed generation can therefore reduce the number of possible combinations an attacker needs to test.

For users whose wallets were created with affected Coldcard firmware, updating the device alone would not repair a seed that had already been generated with weak randomness. Moving funds to a wallet created from a newly generated secure seed would be required to remove exposure associated with the compromised seed.

The incident affected a hardware wallet line that received its first major hardware revision in several years earlier in 2026. Coinkite launched the Coldcard MK5 in March, with the device becoming the first hardware update to its flagship MK series since the MK4 arrived in 2022.

The MK5 retained the previous model’s dual secure-element architecture using chips from two different vendors and kept private keys air-gapped. Its main changes included a 1.54-inch Gorilla Glass display, redesigned physical buttons and improved NFC functions.

Coinkite said at the time that the five major MK5 upgrades focused on usability while preserving the security architecture used by the previous model.

Customer data leaks have created separate phishing risks

Hardware wallet owners have also faced security incidents outside the devices themselves, with recent breaches involving Trezor and SafePal exposing customer and order information belonging to more than 53,000 people.

Trezor attributed the exposure of information belonging to 13,689 customers to shipping provider ShipMonk. SafePal separately said an authorisation flaw in an order-tracking plug-in exposed details connected to 39,798 customers.

Neither incident compromised the companies’ hardware wallets, private keys or recovery phrases, according to the respective disclosures. Both companies warned that exposed personal and order information could instead be used for targeted phishing and impersonation attempts.

Such information can give attackers details needed to make wallet-related scams appear more credible. Earlier in February, attackers sent physical letters impersonating Trezor and Ledger and instructed recipients to complete supposed authentication or transaction checks.

The physical phishing campaign used official-looking correspondence containing QR codes that directed recipients to malicious websites. Some letters created urgency by claiming users had to complete an authentication process to avoid problems accessing their wallets.

The websites asked victims to enter 12-, 20- or 24-word recovery phrases under the pretence of verifying ownership. Once submitted, the phrases were transmitted to the attackers, allowing them to recreate the wallets and gain control over the associated funds.

Trezor and Ledger said legitimate hardware wallet providers do not ask customers to enter, scan, upload or share recovery phrases through websites or other external channels. Recovery phrases should only be entered directly on a hardware wallet when restoring a wallet, according to the companies.

Crypto exchange Kraken has launched trading in more than 7,000 U.S.-listed stocks for eligible customers across the European Economic Area, placing traditional shares alongside more than 700 tokenized xStocks and over 600 crypto assets in the same account.

The Block reported on Aug. 18 that the service has become available across the EEA after Kraken quietly began introducing stock trading to customers in Germany, the Netherlands and France in recent days.

The rollout takes Kraken’s traditional equities business outside the United States, where the exchange first entered stock trading in 2025, while giving European customers two ways to gain exposure to U.S.-listed companies through the same platform.

Kraken said eligible EEA customers can buy traditional shares or use xStocks, its blockchain-based products tied to listed equities and exchange-traded funds. Both products can be accessed without transferring funds between separate platforms.

“With U.S.-listed stocks and xStocks available side-by-side in a single regulated account, customers can choose how they access the same underlying exposure — whether through traditional shares or tokenized representation — without moving capital or changing platforms,” Mark Greenberg, chief commercial officer of Kraken parent Payward and head of Payward Services, said in a statement.

Kraken U.S. stock trading reaches eligible EEA customers

Access covers more than 7,000 traditional U.S. stocks through the desktop and mobile versions of Kraken Pro as well as the main Kraken mobile app.

Kraken said stock trades will carry no trading commission, subject to its applicable terms. Eligibility will not be automatic for every existing customer, however, as users must accept additional terms and conditions before the equities feature becomes available.

The service is being provided by Payward Europe Digital Solutions (CY) Limited, a Cyprus investment firm authorised under the European Union’s Markets in Financial Instruments Directive II, or MiFID II.

Alongside the conventional securities offering, customers can access more than 700 xStocks and over 600 crypto assets through their Kraken accounts. The company said xStocks have processed more than $38 billion in total transaction volume since launching in June 2025.

Kraken describes the setup as distinct from European platforms that provide only one form of U.S. equity exposure. Bitpanda offers traditional U.S. stock trading, while platforms including Robinhood and Crypto.com have introduced tokenized U.S. equity products for European users.

Crypto.com, for example, recently launched tokenized stock derivatives tracking about 1,500 U.S. stocks and ETFs for eligible EEA customers and users in other approved markets. Its products provide synthetic price exposure and do not give buyers legal or beneficial ownership of the underlying securities.

xStocks have moved into more parts of Kraken’s trading system

Kraken has continued adding functions to xStocks since the products were introduced in June 2025, taking them beyond instruments used solely to track the price of conventional equities.

In July, crypto.news reported on Kraken allowing eligible users to post selected xStocks as collateral for futures and margin positions on Kraken Pro. Ten assets initially qualified, including tokenized versions of Apple, Nvidia, Tesla, Strategy, Robinhood, the SPDR S&P 500 ETF and the Invesco QQQ ETF.

Futures collateral was made available to qualifying clients outside the United States, including customers in the EEA. Margin collateral was offered outside the U.S. but excluded EEA clients.

Kraken had also developed dedicated onchain infrastructure for the product earlier in 2026. Its xStocks platform introduced xChange in March, an execution layer initially supporting more than 70 tokenized equities across Ethereum and Solana.

At that point, xStocks had generated about $25 billion in total trading volume, including $3.5 billion in onchain transactions, while more than 80,000 onchain holders had interacted with the products. Each token was described as fully collateralised and backed 1:1 by its corresponding underlying security.

Kraken’s current figures put total xStocks transaction volume above $38 billion, showing how quickly activity has increased since the March tally.

Payward is taking xStocks into more international markets

Payward has also been preparing to add equities from markets outside the United States to the xStocks system.

A July partnership with GTN set out plans to begin with Hong Kong-listed shares before adding securities from the United Kingdom, Europe, South Korea and other markets, subject to the necessary licences and regulatory approvals.

Under the agreement, GTN is providing execution, custody, ledgering and record-keeping infrastructure across more than 90 financial markets, while Payward continues to supply the tokenization infrastructure used to create the blockchain-based assets.

At the time of the July announcement, xStocks supported more than 500 tokenized assets and had generated over $37 billion in transaction volume. Payward also said GTN could eventually distribute xStocks to institutional customers once the required approvals are secured in individual markets.

The latest EEA rollout concerns conventional U.S.-listed securities alongside existing xStocks, while Kraken said it plans to take the combined traditional-stock and tokenized-equity service into additional markets over the coming months.

Tokenized equities have taken a larger share of RWA activity

The expansion comes as tokenized equities have become a larger part of the real-world asset market.

According to figures cited by The Block, tokenized equities now account for about 15% of the RWA market, around three times their share at the start of 2026. The segment has reached roughly $2.8 billion in total market capitalisation, with Ondo Finance, Binance’s bStocks and Kraken’s xStocks accounting for a combined 77%.

Kraken has also expanded what holders can do with the securities represented through xStocks. Earlier in August, the platform extended shareholder voting rights to more than 125,000 xStocks holders, allowing eligible investors to instruct the underlying custodian on how votes should be cast at company shareholder meetings.

The feature changed the original structure of xStocks, which did not provide voting rights when the products launched in June 2025. The arrangement relies on the custody structure operated by Backed Assets (JE) Limited, according to the report.

Kraken parent Payward, meanwhile, reported $508 million in adjusted revenue for the second quarter, up 17% from the same period a year earlier. Adjusted EBITDA reached $23 million for the three months ended June 30.

Total platform transaction volume fell 13% year over year to $310 billion during the quarter, while Payward reported that the composition of trading activity moved toward equities and tokenized equities.

Bitcoin BTC$64,076.23 scored a rare achievement on Monday by outperforming the S&P 500.

The largest cryptocurrency rose 2.6% to over $64,000, registering its best daily performance in over a month, according to CoinDesk data. Wall Street’s benchmark equity index, S&P 500, fell by 0.52%.

Bitcoin, therefore, not only outpaced equities but moved in the totally opposite direction. This was once a norm. Bitcoin has spent most of its history being the higher-beta asset relative to stocks, meaning it typically moves more than stocks in both directions.

“BTC outperformed the stock market today. This has become a less common occurrence lately. 1/2 In fact, BTC only outperformed the S&P 500 on around one third of trading days over the last three months,” blockchain analytics firm Glassnode said in a Telegram chat.

Underperforming two-thirds of the time means BTC has been acting less like a higher-beta asset relative to stocks and more like a laggard. Key reasons for that include the AI stock frenzy on Wall Street that has sucked out capital from other corners of the financial market, including cryptocurrencies.

The bear market phase of bitcoin’s self-fulfilling four‑year cycle has also played a role in keeping demand for BTC subdued. BTC peaked above $126,000 in October last year and quickly entered the bear market, which is expected to bottom out by October this year.

Bitcoin (BTC) short liquidations hit their highest in almost one month as it hit $64,500 on Monday, new data reveals.

Key points:

• Bitcoin passed $64,000 thanks to a short squeeze on derivatives markets, CryptoQuant says.
• An ongoing downward funding-rate reset from 0.006% to 0.003% over 24 hours could mean further short squeezes.
• The absence of spot demand raises doubts whether the upside is sustainable after a week of $267.2 million in net ETF outflows.

Bitcoin short liquidations near one-month high 

BTC/USD rallied after Sunday’s weekly close, gaining up to 3% on Monday to top out at one-week highs of $64,550 on Bitstamp. 

BTC/USD one-hour chart. Source: Cointelegraph/TradingView

Examining the impetus behind the latest BTC price gains, onchain analytics platform CryptoQuant pointed to illiquid markets and funding-rate imbalances among exchanges.

Before rebounding on Monday, BTC circled near $62,750. Around this level, funding rates between exchanges began to diverge. Shorts were dominant on major platforms such as Binance, Bybit, OKX and Deribit, while the funding rate on HTX briefly spiked to 0.05%.

Funding rates refer to periodic payments exchanged by long and short traders on Bitcoin derivatives markets in order to maintain their positions. Positive aggregate funding rates show that long traders are actively paying shorts, with the reverse true for negative funding rates.

“This crowded short positioning served as the primary catalyst, fueling a short squeeze that drove prices higher,” CryptoQuant continued.

BTC/USD one-hour chart with exchange funding-rate data (screenshot). Source: CryptoQuant

Data puts total Bitcoin short liquidations at 637 BTC for Monday, the largest single-day tally since July 21.

Describing the event as a “low-volume liquidity trap,” CryptoQuant nonetheless suggested that the market could see more short squeezes next, with funding rates already declining again as traders increase short exposure.

Bitcoin short liquidations. Source: CryptoQuant

Crucial spot demand remains absent

Previously, Cointelegraph reported that Bitcoin futures markets accounted for the majority of trading volume in the current range, with spot traders broadly uninterested. 

Related: BTC price loses 200-week trend line as 2022 repeats: Five things to know in Bitcoin this week

In further analysis on Monday, CryptoQuant called the lack of spot demand the primary hurdle to sustained upside, alongside the lack of inflows to the US spot Bitcoin exchange-traded funds (ETFs).

“A break below $60K alongside rising exchange inflows would weaken the structure and increase downside risk toward $50K. Selling pressure is cooling, but demand still needs to return,” it commented.

Recent buyers who remain underwater on their BTC allocation have helped cement the current trading range. Short-term holders — wallets holding a UTXO for less than 155 days — have their cost basis at around $68,700, reinforcing that level as resistance.

HTX said on Aug. 18 that it is investigating small cryptocurrency transfers received by several addresses after community members attributed the deposits to the exchange.

The exchange said its initial internal review found that its official channels had not initiated the transfers or conducted related testing. HTX is now examining the origin of the transactions and whether blockchain address labels or attribution methods produced a misleading connection.

Some users have described the transactions as “address poisoning.” Others reportedly said their accounts faced restrictions after receiving the funds. Neither description has been independently confirmed through transaction records, platform notices or findings from a blockchain security company.

HTX says it did not initiate the disputed transfers

HTX responded after community members circulated screenshots of small deposits that appeared to come from exchange linked addresses. One user reportedly received 7.5 USDT in a Coinbase account before being asked to explain the source of the funds, according to a report.

A request for information does not necessarily mean an account has been frozen. Coinbase has not publicly addressed the reported case, and no affected user has published a complete platform notice showing a permanent restriction linked to the transfer.

HTX said it had “not conducted any related transfers or testing activities.” The exchange added that it would not speculate before completing its investigation. It promised to provide the community with confirmed information, although it did not set a deadline.

The statement did not identify the blockchain involved, the sending addresses or the transaction hashes. It also did not disclose how many recipients had reported deposits or whether any customer assets were at risk.

Small deposits do not prove address poisoning

Address poisoning normally involves an attacker creating an address that resembles one previously used by a target. The attacker then sends a small or zero value transaction so that the lookalike address appears in the target’s transaction history.

The attacker hopes the user will later copy the planted address without checking every character. Chainalysis describes this transaction history manipulation in its security guide.

Small unsolicited transfers alone do not establish address poisoning. Investigators would need to determine whether the sender resembles a trusted counterparty and whether the transaction was intended to manipulate a recipient’s address history.

The current reports contain no verified evidence that recipients later sent assets to lookalike addresses. No losses have been confirmed. No security researcher has publicly connected the disputed transfers to a specific operator.

As previously reported, a user recently lost 100,000 USDT after copying a planted lookalike address from their transaction history. That case included a confirmed misdirected payment, unlike the activity HTX is investigating.

Wallet labels may explain the apparent HTX connection

Blockchain transactions identify addresses, but they do not automatically identify the legal entity controlling each address. Explorers and analytics companies assign labels using disclosed ownership information, transaction patterns and address clustering.

Those methods can produce useful leads, but a displayed label is not conclusive proof that the named exchange authorized a transfer. Deposit addresses, consolidation wallets, payment processors and intermediary services can further complicate attribution.

HTX said its investigation would consider “address tagging” and the identification of onchain transfer sources. This leaves open the possibility that third party services attributed a sender to HTX incorrectly or without enough supporting evidence.

The exchange previously published a scam warning about unsolicited 0.001 USDT transfers. It advised users to inspect complete wallet addresses instead of relying on shortened address displays or transaction histories.

The present case also arrives amid wider concerns about automated compliance screening. In related coverage, users reported blocked transactions and frozen funds after compliance services flagged exposure to HTX linked addresses. Those earlier restrictions involved sanctions screening and do not prove a connection to the latest deposits.

Account freeze reports require further evidence

Claims that some accounts were “frozen” remain unverified. No exchange has confirmed imposing restrictions because of the disputed transfers, and the available reports do not provide case numbers, notices or affected wallet addresses.

A platform may request information when an automated monitoring system detects an unfamiliar counterparty or a link to a flagged address. Such a review can delay access without proving misconduct by the recipient or the sending address.

The distinction matters because describing every compliance check as a freeze could overstate the event. It could also wrongly suggest that HTX users conducted a coordinated poisoning campaign when neither HTX nor an independent investigator has reached that conclusion.

HTX’s investigation will need to identify the sending addresses, establish who controlled them and explain why they made the transfers. Publishing transaction hashes would allow independent analysts to test the exchange attribution and search for lookalike address patterns.

Until then, users should avoid copying destination addresses from transaction histories. They should verify the full address, use saved address books where available and preserve transaction hashes or account notices for support teams. Interacting with an unsolicited token or unfamiliar contract may introduce separate security risks.

HTX said it would share further findings once confirmed. The exchange has not announced when the review will end or whether it plans to publish a technical report.

BitBox, the Swiss hardware-wallet provider, has released a firmware update aimed at correcting two security vulnerabilities it characterized as “severe.” According to a security disclosure published on Monday, the patches address issues that could theoretically allow a malicious host to interfere with device behavior and, in one case, affect how Bitcoin is routed during Silent Payments.

Key takeaways

• BitBox says its new firmware fixes a “severe” memory corruption issue affecting Multi editions of BitBox02 and BitBox02 Nova when the device has no wallet configured.
• The company also patched a “severe” weakness in its Silent Payments implementation that could potentially cause Bitcoin to be locked to an unintended address.
• BitBox reported receiving no claims that either vulnerability has been exploited in the wild or caused user losses.
• The update arrives amid heightened scrutiny of hardware-wallet supply chains and device security after high-profile wallet-related incidents.

What BitBox says the firmware update changes

In its disclosure, BitBox describes one vulnerability as a form of memory corruption involving Multi editions of BitBox02 and BitBox02 Nova. The issue is tied to scenarios where the device has not been configured with a wallet, meaning it’s in a state where it could be more vulnerable to abnormal interactions.

BitBox warns that a malicious host could exploit the flaw to execute arbitrary code and potentially install malicious firmware. If such an attack succeeded, it could compromise the device’s ability to protect user funds. As part of its disclosure, the company states it has not received reports indicating the vulnerability has been used to harm users.

Silent Payments patch: risk of unintended locking

The second vulnerability affects BitBox’s Silent Payments feature. BitBox says that while the flaw would not directly enable theft, it could allow a malicious host to lock Bitcoin to an address chosen by the attacker rather than the intended recipient.

In practical terms, BitBox frames the threat as leverage instead of direct extraction: an attacker could potentially demand a ransom to cooperate with restoring access to the coins. BitBox also says it has not seen reports of this issue being exploited or leading to lost funds.

Why the timing matters for self-custody security

BitBox’s firmware release lands at a moment when the hardware-wallet ecosystem is being tested on multiple fronts: device firmware integrity, secure generation of wallet data, and even the protection of customer and order information around wallet products.

Earlier coverage tied a Coldcard hardware-wallet issue to a March 2021 firmware change that remained undetected for more than five years. That vulnerability reportedly affected wallet-seed randomness, enabling attackers to brute-force impacted wallet seeds and derive private keys without physical access. Galaxy Research said last Friday that Coldcard-related losses had exceeded $112 million, with about 1,778.6 BTC reportedly swept from more than 8,600 addresses. (The earlier analysis is described in Cointelegraph’s reporting: Coldcard’s 5-year flaw reveals hardware-wallet testing gap.)

Beyond device bugs, separate incidents also drew attention to the broader risk surface of hardware-wallet businesses. Cointelegraph previously reported data breaches involving Trezor and SafePal that exposed customer and order information for more than 53,000 people. Those cases did not compromise device security, private keys, or recovery phrases. Instead, they raised concerns about targeted phishing and impersonation attempts—risks that can be especially dangerous for users who can be tricked into handing over seed material or signing approvals.

What users should watch after installing updates

Hardware-wallet vulnerabilities are not always limited to “theft bugs.” As BitBox’s disclosure shows, threats can also emerge from interaction patterns—such as how a device behaves before a wallet is configured—or from optional features like Silent Payments, where errors can affect the destination of funds rather than enabling immediate draining.

For BitBox users, the key next step is straightforward: install the firmware update and confirm the device is operating under the latest version recommended by the vendor. Readers may also want to review their operational habits around Silent Payments usage and ensure they are comfortable with how their wallet constructs and verifies outputs before signing.

More broadly, the pattern across recent incidents suggests that self-custody security depends on a full chain—not only the cryptography inside the hardware, but also firmware correctness, feature-specific logic, and the surrounding processes that keep customer interactions from becoming an entry point for social engineering.

With BitBox now shipping a fix and reporting no known exploitation, the remaining question for the market is whether broader scanning and third-party auditing will surface additional edge-case weaknesses in similar workflows across other devices and features. Users should treat firmware updates as an ongoing part of operational security, not a one-time task.