We count visits with Cloudflare Web Analytics, which uses no cookies.
Google Analytics does use cookies, so it only runs if you accept.
What each one does
Your browser is sending a privacy signal (Global Privacy Control or
Do Not Track), so Google Analytics stays off on this site.
There is nothing to accept. Details
Results open on Google Search, which receives the words you type. Press Esc to close.
Is my Bitcoin wallet affected by a known security problem?
Most wallets are not affected by anything on this page. It lists recent security problems in wallets and
devices that Knowing Bitcoin writes about. For each one you will find who it affects, what to do, and a link to
the company’s own notice.
Not an exhaustive list. Always check your manufacturer's security page.Official security pages
Not listed? That does not tell you whether it is safe. This page only covers some products. Check your
manufacturer’s security page below.
What the labels mean
Under investigation
The companies are still investigating. Details may change.
Action needed if affected
A fix is out. If you are affected, you need to do something.
Resolved
The attack has stopped and the company has explained what happened. A few good habits are listed.
Open and recent advisories
Under investigationLedger and Trezor hardware wallets bought from the reseller CryptoBilis (Southeast Asia)
Ledger and Trezor devices sold by CryptoBilis: a hidden implant that copies the recovery words (confirmed by Ledger, reported to Trezor)
First official notice
Latest official update
Last checked by Knowing Bitcoin
CryptoBilis was an authorized reseller of both Ledger and Trezor in Southeast Asia. On 10 October 2026 Ledger confirmed that a device sold through CryptoBilis contained an unauthorized hardware implant. According to Ledger’s security team, the implant “reads the data shown on the screen” during setup, decodes the 24 recovery words and sends them out over a mobile (LTE) connection. On 30 October Trezor said it had a credible report, not yet examined in its lab, of a similar implant in one Trezor Safe 5 bought from CryptoBilis in August 2026. Trezor also said no CryptoBilis buyer had reported a loss of funds to it.
Who is affected
Ledger (13 October): anyone who bought a Ledger device from CryptoBilis.
Trezor (30 October): anyone who bought any Trezor model from CryptoBilis from March 2026 onwards, including from stores selling devices supplied by CryptoBilis, such as its store on Tokopedia.
Still open
Ledger, 13 October: “We are also reviewing reports of implants in other signers and locations.”
Trezor, 30 October, about the reported Trezor Safe 5: “Our security team will examine the device as soon as it arrives.”
What to do
Not set up yet? Don’t set it up, and never type an existing recovery phrase into it. Contact Ledger or Trezor support through their official websites.
Already using it? Move your funds as soon as you can to a new wallet with a brand-new seed, made on a different device. Ledger: “Do not enter or restore any recovery phrase on a signer bought from CryptoBilis.”
Don’t open it, weigh it or send it to anyone yet. Trezor says there is no dependable way to inspect a device yourself and that weighing isn’t a reliable test. Ledger asks you to speak to its support, and to local police if you lost funds, before you send or open it.
Expect fake “support”. Trezor warns that scammers will likely use this incident with fake emails, letters and phone calls. Ledger says it will never call you, message you directly or ask for your 24 words.
Common mistake: Restoring the recovery words from that device onto another device. That does not fix this, because the words may already have been copied. Trezor: “Using the wallet backup generated by the tampered wallet on another device does not solve the issue.”
Trezor’s advice if you have no other hardware wallet, quoted in full (30 October 2026):
If you don’t have a secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with. Before sending any funds, carefully check the full receiving address to avoid any mistakes.
Trezor says anyone who bought from CryptoBilis from March 2026 onwards can get a replacement device or a voucher. Keep the CryptoBilis device and contact Trezor Support.
Action needed if affectedElectrum wallet, versions before 4.8.3
Electrum: a fake transaction could trick you into paying an attacker when you raise the fee
First official notice
Last checked by Knowing Bitcoin
Electrum is a light wallet: it trusts the server it connects to for news of unconfirmed transactions. After you sent a payment, a malicious server could hide it and show your wallet a fake one that paid the attacker instead. If you then raised the fee (RBF), you signed a real transaction that paid the attacker. Electrum’s developers say some servers are already doing this “in the wild”. They received two reports, and one of those users lost money.
Who is affected
Electrum versions before 4.8.3, connected to a server you don’t control.
Not affected, according to the company
Electrum: “Clients that connect to servers they trust (e.g. run their own) are not affected.”
Electrum 4.8.3 and later, which now check the signatures on your own unconfirmed payments before showing them.
What to do
Update to Electrum 4.8.3 or later, downloaded only from electrum.org.
Before you sign any transaction, including a fee bump, check the full address and the amount. If you use a hardware wallet, check them on its screen.
If you run your own Electrum server, connect only to it.
Common mistake: Checking only the end of an address is not enough. In both reports, the attacker’s address had been made to end in the same four characters as the real one.
Action needed if affectedColdcard Mk2, Mk3, Mk4, Mk5 and Q (Coinkite)
Coldcard: seeds made on older firmware can be guessed
First official notice
Latest official update
Last checked by Knowing Bitcoin
A firmware bug meant some Coldcards built seeds from a predictable software generator instead of the chip’s hardware random number generator. Attackers recreated those seeds on their own computers and emptied the wallets. The devices themselves were not hacked. Coinkite says seeds made on a Mk4, Q or Mk5 before the fix have “about 72 bits of entropy rather than the expected 128 bits”, and that the older Mk2 and Mk3 were weakened more.
Who is affected
Seeds generated on a Mk2 or Mk3 running firmware 4.0.1 (March 2021) to 4.1.9.
Seeds generated on a Mk4 or Mk5 before firmware 5.6.0, or before 6.6.0X on the Edge track.
Seeds generated on a Q before firmware 1.5.0Q, or before 6.6.0QX on the Edge track.
Not affected, according to the company
A seed made with at least 50 fair, independent, private dice rolls added when it was created (Add Dice Rolls), if the rolls were never recorded or exposed. Coinkite: “we do not consider the resulting seed at risk from this RNG issue alone.” If you are not sure how many rolls you entered, treat the seed as affected.
TAPSIGNER, OPENDIME and SATSCARD, which use different code.
What to do
Find out which Coldcard made your seed and which firmware it was running. Our two-minute check walks you through it.
Install fixed firmware downloaded from coldcard.com, and verify the download, before you make a new seed. On 1 October 2026 Coinkite recommended 5.6.3 for Mk4 and Mk5 and 1.5.3Q for Q. For Mk2 and Mk3, 4.2.0 is the final release.
Before you make the new seed, test the backup of your current words and write down your wallet’s fingerprint. That is an 8-character code: the Coldcard shows it as the Master Key Fingerprint under Advanced/Tools > View Identity. Later it tells you which wallet is loaded. Coinkite: “Never destroy the only working copy of a wallet. Never rely on an untested backup.”
Make the new seed on a second Coldcard running fixed firmware, if you have one. With only one Coldcard, follow the one-device path in Coinkite’s migration guide. Write the new words down and test them, confirm a receive address on the Coldcard’s screen, send a small test amount, then move the rest. Keep the old backup until everything has arrived. If a fingerprint or address does not match, stop: don’t send anything and don’t erase either backup.
Take your time. Coinkite: “Rushing a wallet migration can create a more immediate risk than the issue you are trying to address.”
Common mistake: Updating the firmware does not fix a seed you already have: it only fixes seeds made after the update. Coinkite: “Updating the firmware does not change or repair an existing seed.”
A strong BIP-39 passphrase adds a barrier, but it does not repair the seed. Coinkite says passphrase users should also move to a new seed “as soon as practical”.
Action needed if affectedBitBox02 and BitBox02 Nova (BitBox)
BitBox02 and BitBox02 Nova: update to firmware 9.26.5 or later
First official notice
Last checked by Knowing Bitcoin
BitBox’s August 2026 update, firmware 9.26.5, fixes two severe flaws that its own engineers found. BitBox also disclosed that a bootloader flaw it had already fixed in 9.26.2 was more serious than first reported. Each of these needed something extra from an attacker: a fake BitBoxApp, or a compromised computer or phone. BitBox says: “There are no reports of stolen user funds and there is no reason for users to panic.”
Who is affected
BitBox02 on firmware up to 9.26.1, if you installed a fake BitBoxApp bundled with malicious firmware. This one was fixed in 9.26.2, and the BitBox02 Nova is not affected by it.
Multi editions of the BitBox02 and BitBox02 Nova up to 9.26.4, if no wallet had been set up yet and the device was used with a malicious computer or phone.
BitBox02 and BitBox02 Nova from 9.21.0 to 9.26.4, if you sent to a silent payment address using a malicious computer or phone. BitBox says this could not steal funds directly, but could lock them to an unintended address.
Not affected, according to the company
Any BitBox on firmware 9.26.5 or later.
The Bitcoin-only edition is not affected by the memory flaw, because its firmware does not contain that code.
What to do
Open the BitBoxApp you already have and follow its update banner, or download the app only from bitbox.swiss.
Plug in your BitBox and install the new firmware from the app’s Manage device settings. Then check that the app shows 9.26.5 or later.
Ignore any email or message about this update that asks for your recovery words.
Common mistake: Moving your coins to a new wallet. There is no need: BitBox says “Your existing wallet seed is not affected in any way.” Updating the firmware is the whole fix.
The newest BitBox firmware on 3 November 2026 was 9.27.1, released on 31 August 2026.
Blink: custodial accounts emptied through a flaw in its admin tools, and every balance restored
First official notice
Latest official update
Last checked by Knowing Bitcoin
On 19 September 2026 an attacker used a flaw in Blink’s admin tools to take over custodial accounts and withdraw bitcoin from 24 of them. Blink switched the service off within 15 minutes of the first customer report and closed the flaw that day. On 24 September it restored every affected balance in full, with withdrawal fees refunded. The attacker also looked up the details of 3,817 other accounts; for some, that included a phone number or an email address. Blink says the attacker “did not see names, identity documents, addresses, passwords or seed phrases”.
Who is affected
Blink custodial accounts. If yours was involved, Blink says it contacted you through a message in the Blink app.
Not affected, according to the company
Non-custodial Blink accounts. Blink: “we don't hold those keys, so there was nothing for the attacker to take.”
What to do
Turn on two-factor authentication in Blink (Settings → Security and Privacy → Two-factor authentication), and on your email account too.
If you log in only with a phone number, add an email login as well: a phone number can be SIM-swapped.
If you use Blink’s API, create a new key. Blink revoked all customer API keys.
Ignore emails or text messages about this incident that contain a link. Blink says it will never ask for your PIN, password, seed phrase or a login code, or ask you to move funds.
Common mistake: Treating two-factor authentication as optional. It is what stopped the attacker: nine of the targeted accounts had it switched on and lost nothing, and none of the 24 drained accounts had it.
ResolvedPeople subscribed to the Trezor or BitBox newsletters
Fake “security alert” emails sent through the Trezor and BitBox newsletters
First official notice
Latest official update
Last checked by Knowing Bitcoin
In September 2026 attackers broke into Brevo, the email service that Trezor and BitBox use for their newsletters, and sent phishing emails from the companies’ own newsletter accounts. Trezor’s email had the subject “Critical Security Alert: STM32 Entropy Vulnerability” and pushed an app that asked for the wallet backup. BitBox’s email falsely claimed a flaw in the BitBox and linked to a website asking for recovery words. Both companies say the fake sites were taken down quickly. The subscriber lists were downloaded, so more targeted phishing may follow.
Who is affected
Trezor newsletter subscribers. Trezor says 347,149 email addresses were exported.
Subscribers to BitBox’s newsletter, affiliate and tutorial emails. BitBox says the whole contact list was downloaded, and that it held email addresses only.
Not affected, according to the company
Trezor: “If you have not entered your wallet backup anywhere other than on your Trezor device during recovery, your assets remain secure.” Trezor adds that clicking the link alone does not expose your funds.
BitBox: placing a shop order does not make you affected, and if you only received the email and did nothing, there is no need to reset your BitBox or move funds.
What to do
Don’t click links in emails about a wallet “security alert”. Type the manufacturer’s web address yourself.
If you typed your recovery words into a website or app from such an email, move your funds to a new wallet with a new seed now. Trezor says to do it immediately; BitBox asks you to contact its support for help, and never to include your words in the request.
Expect more phishing at the email address you subscribed with.
Common mistake: Trusting an email because the sender looks genuine. BitBox says these emails passed the usual email authentication checks, because they really were sent through the companies’ newsletter service. A request for your recovery words is what proves it is a scam.
An email from your wallet’s maker says there is a critical flaw and asks you to confirm your 24 words on a web page. What do you do?
Nothing on that page. It is a scam, even if the sender looks genuine: in September 2026 fake alerts went out
through the real Trezor and BitBox newsletters. Delete it, then check the maker’s security page by typing the
address yourself.
You updated your Coldcard to fixed firmware. Is the seed you made before the update safe now?
The update did not change it. An update only fixes seeds made after it. If your seed was made on affected
firmware, replace it with a new seed and move the funds to it. The one exception is a seed made with at least
50 fair, private dice rolls that were never recorded. Not sure how many rolls you added? Treat the seed as
affected. Our two-minute check walks you through it.
Your device isn’t on this page. Does that mean it is safe?
Not necessarily. This list is not complete. Check your manufacturer’s security page, and keep your firmware up
to date.
How this page works
Each card is based on the company’s own notice, which we read on the date shown on the card. Where a company
is quoted, the words are theirs, unedited.
We update this page when we can. It is not a real-time alert service, so your manufacturer’s page comes first.
This page gives security steps only. It is not financial advice about what to buy or sell.
Knowing Bitcoin earns a commission from BitBox, Keystone, Umbrel and Start9 (see our
disclosure). This page carries no affiliate links.
