BitBox

Every app in your pocket answers to someone. Your money doesn't have to.

Danke, ist bereits fürs nächste Update gefixt!

What if your BitBox could speak German? 👀

How did we integrate Lightning into our hardware wallet? @douglasbakkum is talking about it in @bitcoinconfams 🚀

So many memories

12/ You can also find this article in other languages: Deutsch 🇩🇪: blog.bitbox.swiss/de/verlass… Español 🇪🇸: blog.bitbox.swiss/es/no-conf…

11/ You don't need to predict the next exploit to limit its damage. Keep your phone updated. Keep backups offline. Give your savings protections that survive a compromised phone. Read the full article: blog.bitbox.swiss/en/dont-tr…

10/ A hardware wallet does not protect funds left on an exchange. Those still depend on the provider's custody and account security. Use independent security keys, review recovery methods, and enable withdrawal address lists and delays where available.

9/ This distinction applies inside the BitBoxApp too the new Lightning wallet is a hot wallet, as its keys are stored on the phone. A BitBox-derived backup helps recovery; the Lightning keys stay on the phone.

8/ A hardware wallet reduces reliance on your phone by handling transaction signing on a separate device. That separation only works if your backup stays separate too.

7/ For funds still being held on an exchange, an attacker does not need your Bitcoin private keys. They need sufficient access to the exchange account. Logging in is not the same as staying logged in. Services often remember an authenticated session using a session token.

6/ These exploits can reach crypto thieves too. @Google tracked Coruna, an iPhone exploit kit, moving from surveillance-related operations into financially motivated campaigns, including fake crypto websites. The malware searched for recovery words and targeted wallet apps.

5/ A malicious message doesn't always need to be opened. A zero-click exploit can strike while your phone processes it automatically. A zero-day exploits a flaw before it is known and a fix is available. An attack can be both. Updating helps once a fix exists.

4/ Finding and fixing bugs helps; a low report count alone doesn't prove a device is safer. What matters is what an attacker can actually exploit, what a successful attack exposes, and what protections remain afterward.

3/ Annual CVE disclosures, reports of software vulnerabilities, have risen sharply. AI-assisted research is finding flaws in everyday apps as well as hardware wallets.

2/ You enter your exchange password, get a code from your authenticator and use email if you need to recover access. Those safeguards may all live on one phone. An attack that crosses app boundaries can affect several at once, along with your phone wallet.

1/ Your phone can hold your wallet, your exchange and bank logins, and the 2FA codes meant to secure your accounts. Several layers... all on the same phone. What happens if that one device is compromised? A thread 🧵👇