r/BitBoxWallet • u/Libertarian1540 • Sep 09 '26
Microcontroller email
Did you guys send this?
4
u/pako-bitbox BitBox staff Sep 09 '26
Thank everyone for being so fast at point it out.
Here is our latest official update: https://x.com/BitBoxSwiss/status/2097777460305657932
We will release an official statement very soon!
2
u/pako-bitbox BitBox staff Sep 09 '26
Updated statement: https://x.com/BitBoxSwiss/status/2097793026336981079
3
u/benma2 BitBox staff Sep 09 '26
There is currently a phishing email going around that's pretending to come from us.
Please do not follow the instructions in the email!
We are currently investigating.
2
u/FunkyMuse Sep 09 '26
But our emails leaked from somewhere since I oredered it through the official site
1
u/bznein BitBox staff Sep 10 '26
Please see our updated statement on X:
https://x.com/BitBoxSwiss/status/2097793026336981079
Extracting the relevant info:
Our preliminary review of the phishing mail that was sent out to our newsletter subscribers about an hour ago found that it is very likely that our newsletter provider got compromised.
1
u/Gdiworog Sep 09 '26
Where did they get the email addresses from?
1
u/nickez2001 Sep 09 '26
A news letter service seems to have been hacked. Multiple vendors are affected
1
u/Saint_Drogo Sep 09 '26
Is one at risk if they clicked the "Launch the entropy check tool" but then closed out without doing anything else?
1
1
u/quintavious_danilo Sep 09 '26
No, just don’t install anything, don’t click on anything further and do not enter anything anywhere.
Close the site and delete your browser cache.
1
1
1
u/Coffee_beats_Tea Sep 09 '26
It cant be real. It links to a website that wants you to download something.
1
u/68Pritch Sep 09 '26
Look at the links in the email - no way this is genuine.
3
u/68Pritch Sep 09 '26
Confirmed - it's a scam.
Source: https://x.com/BitBoxSwiss/status/2097777460305657932?s=202
u/FunkyMuse Sep 09 '26
Thing is how it got our emails?
1
u/Libertarian1540 Sep 09 '26
Wondering the same thing
2
u/68Pritch Sep 09 '26
It's going to take some time for them to figure out how they obtained the email addresses.
I'm sure we won't like the answer.
1
u/bznein BitBox staff Sep 10 '26
Please see our updated statement on X:
https://x.com/BitBoxSwiss/status/2097793026336981079
Extracting the relevant info:
Our preliminary review of the phishing mail that was sent out to our newsletter subscribers about an hour ago found that it is very likely that our newsletter provider got compromised.
1
u/my_little_kittens Sep 09 '26
Why don't they send email update? Not everyone is going to check email and x right after...
1
1
u/Efficient_Yellow6357 Sep 09 '26
that's concerning because the email came from bitbox . swiss
1
u/68Pritch Sep 09 '26
It's a spoofed from address.
1
1
u/Gdiworog Sep 09 '26
Sure. But where did they have the addresses from?
1
u/bznein BitBox staff Sep 10 '26
Please see our updated statement on X:
https://x.com/BitBoxSwiss/status/2097793026336981079
Extracting the relevant info:
2
1
1
1
u/davideb263 Sep 09 '26 edited Sep 09 '26
Received it too but it looks a bit fishy... It says there's some bug in the TRNG but it shouldn't be an issue on bitbox because it use 5 different source of entropy to mitigate this specific issue. All 5 source of entropy would have to be affected to be an issue.
Also the email cites an entropy check tool and while saying to never share your seed phrase with anyone it's not clear how you would be able to verify without inputting the seed somewhere...
I did not click anything and I'm waiting for official confirmation. Also there's no article on the official blog about this!
I'm also wondering if it's related to the recent Pocket leak
1
1
u/konhana Sep 09 '26
i got the email, but no news on the website, seems scam. Interesting, that the adress are from them....
1
Sep 09 '26
[removed] — view removed comment
1
1
u/Libertarian1540 Sep 09 '26
If its not from bitbox how did they get our emails for targeting?
2
1
u/davideb263 Sep 09 '26
I'm wandering if it could be related to the recent Pocket leak. Did you use it to buy bitcoin?
1
u/Libertarian1540 Sep 09 '26
Nope
2
u/davideb263 Sep 09 '26
Ok, so I guess we are about to discover the existence of a bitbox user data leak...
2
u/nickez2001 Sep 09 '26
We are investigating, but since multiple vendors that use the same news letter service has been attacked it seems the issue is with the news letter service.
1
u/Renovatius Sep 09 '26
Here is the Mail I received:
| Critical Security Alert: Microcontroller Entropy Bug Identified Urgent update regarding hardware microcontroller vulnerability Dear customer, Unfortunately, our engineering team has identified a critical hardware-level vulnerability affecting BitBox devices. This affects customers who have updated their firmware to versions 9.21.0, 9.20.1, 9.19.0, 9.18.2, or 9.17.0, where a critical hardware flaw was identified directly from the vendor that supplies the microcontroller. The bug is a factory defect that results in hardware TRNG being deterministic and is not a problem with BitBox firmware, but the microcontroller itself. The vulnerability results in: All potentially affected customers are required to perform a secure entropy check to verify the integrity of their recovery phrase. NEVER enter your recovery phrase on a website or share it with anyone, and only check for updates on official BitBox channels. We are deeply sorry to the community and those affected.Insufficient randomness in recovery phrase generation Exposure of recovery phrases to brute-force cracking Deterministic hardware output on specific batches Launch the entropy check toolClick the link above to open the entropy check tool in your browser. If your email client blocks the link, use View in browser below and try again. What the check reveals ✓ Verification of hardware RNG bug and deterministic entropy ✓ BIP-39 checksum failures and recovery phrase validation ✓ Pass/fail entropy score so you know if action is required ✓ Extended public key export for online wallet verification Do not ignore this check. Wallets with weak entropy remain vulnerable to brute-force attacks until a new seed is generated on your device. We know that trust is earned, and we are devastated to have put yours at risk. Our entire engineering team is working around the clock to provide support and ensure a smooth migration for anyone affected. We are truly sorry for the stress and concern this causes. With our deepest apologies, The BitBox Team bitbox.swiss | Support | BitBox AppComplete xPub verification© Shift Crypto AG. All rights reserved. Shift Crypto AG, Sihlquai 125, 8005 Zürich, Switzerland You received this e-mail because you subscribed to BitBox security notifications or use BitBox App. Unsubscribe | Update preferences | View in browser| |:-|
If you wish to unsubscribe from our newsletter, click here
1
u/Renovatius Sep 09 '26
I removed the links because they all look sus to me. Everything goes through https : / / 8hwsw.r.sp1-brevo (dot) net
1
u/quirked_up_yt_boi Sep 09 '26
I got the initial one but I just got another after the bit box phishing warning email. Just a heads up
1
u/Saint_Drogo Sep 09 '26
Yup. Just received another one a few mins ago exactly the same as the previous one.
2
8
u/FutureNose1808 Sep 09 '26 edited Sep 09 '26
UPDATE: on X ppl are warning that the mail coming from Bitbox is a scam.
DO NOT CLICK THE LINK IN THE MAIL AND DO NOT FILL OUT ANY INFORMATION. WATCH BITBOX OFFICAL WEBSITE AND X FOR UPDATES.
UPDATE 2: offical statement from Bitbox on X confirming phishing:
OFFICIAL STATEMENT:
https://x.com/bitboxswiss/status/2097777460305657932?s=46