Recent security problems in Bitcoin wallets and devices: who is affected and what to do, with the official source. Not an exhaustive list. Always check your manufacturer’s security page.https://knowingbitcoin.com/advisories/en-usTue, 03 Nov 2026 12:00:00 GMThttps://knowingbitcoin.com/advisories/#cryptobilis-tampered-devices-2026knowingbitcoin-advisory-cryptobilis-tampered-devices-2026-2026-10-30-ongoingStatus: Under investigation. CryptoBilis was an authorized reseller of both Ledger and Trezor in Southeast Asia. On 10 October 2026 Ledger confirmed that a device sold through CryptoBilis contained an unauthorized hardware implant. According to Ledger’s security team, the implant “reads the data shown on the screen” during setup, decodes the 24 recovery words and sends them out over a mobile (LTE) connection. On 30 October Trezor said it had a credible report, not yet examined in its lab, of a similar implant in one Trezor Safe 5 bought from CryptoBilis in August 2026. Trezor also said no CryptoBilis buyer had reported a loss of funds to it. Who is affected: Ledger (13 October): anyone who bought a Ledger device from CryptoBilis. Trezor (30 October): anyone who bought any Trezor model from CryptoBilis from March 2026 onwards, including from stores selling devices supplied by CryptoBilis, such as its store on Tokopedia. What to do: (1) Not set up yet? Don’t set it up, and never type an existing recovery phrase into it. Contact Ledger or Trezor support through their official websites. (2) Already using it? Move your funds as soon as you can to a new wallet with a brand-new seed, made on a different device. Ledger: “Do not enter or restore any recovery phrase on a signer bought from CryptoBilis.” (3) Don’t open it, weigh it or send it to anyone yet. Trezor says there is no dependable way to inspect a device yourself and that weighing isn’t a reliable test. Ledger asks you to speak to its support, and to local police if you lost funds, before you send or open it. (4) Expect fake “support”. Trezor warns that scammers will likely use this incident with fake emails, letters and phone calls. Ledger says it will never call you, message you directly or ask for your 24 words. Official sources: Ledger Support, https://x.com/Ledger_Support/status/2108551100613714002; Ledger Support, https://x.com/Ledger_Support/status/2108968264055345381; Ledger, https://x.com/Ledger/status/2109896739985453358; Ledger, https://www.ledger.com/blog-response-hardware-implant-attack; Trezor, https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis. Last checked by Knowing Bitcoin on 2026-11-03. No manufacturer will ever ask for your seed words.Fri, 30 Oct 2026 12:00:00 GMTUnder investigationledgertrezorhttps://knowingbitcoin.com/advisories/#electrum-fake-transaction-fee-bump-2026knowingbitcoin-advisory-electrum-fake-transaction-fee-bump-2026-2026-10-24-activeStatus: Action needed if affected. Electrum is a light wallet: it trusts the server it connects to for news of unconfirmed transactions. After you sent a payment, a malicious server could hide it and show your wallet a fake one that paid the attacker instead. If you then raised the fee (RBF), you signed a real transaction that paid the attacker. Electrum’s developers say some servers are already doing this “in the wild”. They received two reports, and one of those users lost money. Who is affected: Electrum versions before 4.8.3, connected to a server you don’t control. What to do: (1) Update to Electrum 4.8.3 or later, downloaded only from electrum.org. (2) Before you sign any transaction, including a fee bump, check the full address and the amount. If you use a hardware wallet, check them on its screen. (3) If you run your own Electrum server, connect only to it. Official sources: Electrum developers, https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v; Electrum, https://electrum.org/. Last checked by Knowing Bitcoin on 2026-11-03. No manufacturer will ever ask for your seed words.Sat, 24 Oct 2026 12:00:00 GMTAction needed if affectedelectrumhttps://knowingbitcoin.com/advisories/#blink-custodial-accounts-sept-2026knowingbitcoin-advisory-blink-custodial-accounts-sept-2026-2026-10-08-resolvedStatus: Resolved. On 19 September 2026 an attacker used a flaw in Blink’s admin tools to take over custodial accounts and withdraw bitcoin from 24 of them. Blink switched the service off within 15 minutes of the first customer report and closed the flaw that day. On 24 September it restored every affected balance in full, with withdrawal fees refunded. The attacker also looked up the details of 3,817 other accounts; for some, that included a phone number or an email address. Blink says the attacker “did not see names, identity documents, addresses, passwords or seed phrases”. Who is affected: Blink custodial accounts. If yours was involved, Blink says it contacted you through a message in the Blink app. What to do: (1) Turn on two-factor authentication in Blink (Settings → Security and Privacy → Two-factor authentication), and on your email account too. (2) If you log in only with a phone number, add an email login as well: a phone number can be SIM-swapped. (3) If you use Blink’s API, create a new key. Blink revoked all customer API keys. (4) Ignore emails or text messages about this incident that contain a link. Blink says it will never ask for your PIN, password, seed phrase or a login code, or ask you to move funds. Official sources: Blink, https://www.blink.sv/blog/sept-19-attack-postmortem-and-bounty; Blink, https://www.blink.sv/blog/phase-two-following-the-coins-in-public. Last checked by Knowing Bitcoin on 2026-11-03. No manufacturer will ever ask for your seed words.Thu, 08 Oct 2026 12:00:00 GMTResolvedblinkhttps://knowingbitcoin.com/advisories/#coldcard-weak-seeds-2026knowingbitcoin-advisory-coldcard-weak-seeds-2026-2026-10-01-activeStatus: Action needed if affected. A firmware bug meant some Coldcards built seeds from a predictable software generator instead of the chip’s hardware random number generator. Attackers recreated those seeds on their own computers and emptied the wallets. The devices themselves were not hacked. Coinkite says seeds made on a Mk4, Q or Mk5 before the fix have “about 72 bits of entropy rather than the expected 128 bits”, and that the older Mk2 and Mk3 were weakened more. Who is affected: Seeds generated on a Mk2 or Mk3 running firmware 4.0.1 (March 2021) to 4.1.9. Seeds generated on a Mk4 or Mk5 before firmware 5.6.0, or before 6.6.0X on the Edge track. Seeds generated on a Q before firmware 1.5.0Q, or before 6.6.0QX on the Edge track. What to do: (1) Find out which Coldcard made your seed and which firmware it was running. Our two-minute check (https://knowingbitcoin.com/tools/am-i-affected-coldcard-2026/) walks you through it. (2) Install fixed firmware downloaded from coldcard.com, and verify the download, before you make a new seed. On 1 October 2026 Coinkite recommended 5.6.3 for Mk4 and Mk5 and 1.5.3Q for Q. For Mk2 and Mk3, 4.2.0 is the final release. (3) Before you make the new seed, test the backup of your current words and write down your wallet’s fingerprint. That is an 8-character code: the Coldcard shows it as the Master Key Fingerprint under Advanced/Tools > View Identity. Later it tells you which wallet is loaded. Coinkite: “Never destroy the only working copy of a wallet. Never rely on an untested backup.” (4) Make the new seed on a second Coldcard running fixed firmware, if you have one. With only one Coldcard, follow the one-device path in Coinkite’s migration guide (https://coldcard.com/security/migrate#one-device). Write the new words down and test them, confirm a receive address on the Coldcard’s screen, send a small test amount, then move the rest. Keep the old backup until everything has arrived. If a fingerprint or address does not match, stop: don’t send anything and don’t erase either backup. (5) Take your time. Coinkite: “Rushing a wallet migration can create a more immediate risk than the issue you are trying to address.” Official sources: Coinkite, https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/; Coinkite, https://coldcard.com/security/status; Coinkite, https://coinkite.com/historical-disclosures; Coinkite, https://coldcard.com/security/migrate. Last checked by Knowing Bitcoin on 2026-11-03. No manufacturer will ever ask for your seed words.Thu, 01 Oct 2026 12:00:00 GMTAction needed if affectedcoldcardhttps://knowingbitcoin.com/advisories/#newsletter-phishing-trezor-bitbox-sept-2026knowingbitcoin-advisory-newsletter-phishing-trezor-bitbox-sept-2026-2026-09-24-resolvedStatus: Resolved. In September 2026 attackers broke into Brevo, the email service that Trezor and BitBox use for their newsletters, and sent phishing emails from the companies’ own newsletter accounts. Trezor’s email had the subject “Critical Security Alert: STM32 Entropy Vulnerability” and pushed an app that asked for the wallet backup. BitBox’s email falsely claimed a flaw in the BitBox and linked to a website asking for recovery words. Both companies say the fake sites were taken down quickly. The subscriber lists were downloaded, so more targeted phishing may follow. Who is affected: Trezor newsletter subscribers. Trezor says 347,149 email addresses were exported. Subscribers to BitBox’s newsletter, affiliate and tutorial emails. BitBox says the whole contact list was downloaded, and that it held email addresses only. What to do: (1) Don’t click links in emails about a wallet “security alert”. Type the manufacturer’s web address yourself. (2) If you typed your recovery words into a website or app from such an email, move your funds to a new wallet with a new seed now. Trezor says to do it immediately; BitBox asks you to contact its support for help, and never to include your words in the request. (3) Expect more phishing at the email address you subscribed with. Official sources: Trezor, https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider; BitBox, https://blog.bitbox.swiss/en/email-address-exposure-at-newsletter-provider-brevo/. Last checked by Knowing Bitcoin on 2026-11-03. No manufacturer will ever ask for your seed words.Thu, 24 Sep 2026 12:00:00 GMTResolvedtrezorbitboxhttps://knowingbitcoin.com/advisories/#bitbox-firmware-9-26-5-2026knowingbitcoin-advisory-bitbox-firmware-9-26-5-2026-2026-08-17-activeStatus: Action needed if affected. BitBox’s August 2026 update, firmware 9.26.5, fixes two severe flaws that its own engineers found. BitBox also disclosed that a bootloader flaw it had already fixed in 9.26.2 was more serious than first reported. Each of these needed something extra from an attacker: a fake BitBoxApp, or a compromised computer or phone. BitBox says: “There are no reports of stolen user funds and there is no reason for users to panic.” Who is affected: BitBox02 on firmware up to 9.26.1, if you installed a fake BitBoxApp bundled with malicious firmware. This one was fixed in 9.26.2, and the BitBox02 Nova is not affected by it. Multi editions of the BitBox02 and BitBox02 Nova up to 9.26.4, if no wallet had been set up yet and the device was used with a malicious computer or phone. BitBox02 and BitBox02 Nova from 9.21.0 to 9.26.4, if you sent to a silent payment address using a malicious computer or phone. BitBox says this could not steal funds directly, but could lock them to an unintended address. What to do: (1) Open the BitBoxApp you already have and follow its update banner, or download the app only from bitbox.swiss. (2) Plug in your BitBox and install the new firmware from the app’s Manage device settings. Then check that the app shows 9.26.5 or later. (3) Ignore any email or message about this update that asks for your recovery words. Official sources: BitBox, https://blog.bitbox.swiss/en/bitbox-08-2026-dixence-update/; BitBox on GitHub, https://github.com/BitBoxSwiss/bitbox02-firmware/releases; BitBox, https://bitbox.swiss/download/. Last checked by Knowing Bitcoin on 2026-11-03. No manufacturer will ever ask for your seed words.Mon, 17 Aug 2026 12:00:00 GMTAction needed if affectedbitbox