Best Crypto Wallets
Top rated: Rabby 8.3
Software wallets for everyday use.
5rated →
8.2/10
Hardware Wallets
Company file: BitBox, owners, incidents →
BitBox02
Swiss-made, open source with reproducible builds, and easier to live with than the hardcore options. The record is not spotless: on 17 August 2026 BitBox fixed two severe firmware bugs its own audits found, and on 10 September 2026 a breach at its newsletter provider Brevo sent phishing from BitBox’s real account. No funds lost through the device have been reported.
Best for: A simple, open, well-built device for people who want neither extreme
Company file: BitBox, owners, incidents →How this score was reached
8.2 is the weighted average of the five pillar findings below. Does the job well with no material unresolved concerns.
- Custody & Security45%
- 8.4
- Cost & Fee Transparency15%
- 7.6
- Regulation & Legal Standing5%
- 7.8
- Performance & Reliability15%
- 8.0
- Access & Support20%
- 8.6
Open-source firmware with reproducible builds and a secure chip; seeds mix five entropy sources, which is why the 2026 Coldcard bug did not apply. Firmware 9.26.5 (17 Aug 2026) fixed two severe internally found bugs — a memory-corruption flaw on un-initialised Multi-edition devices and a silent-payments flaw — and BitBox said a bootloader issue fixed in July (9.26.2) was more serious than first described. No exploitation reported.
Mid-range price, no ongoing cost, and a Bitcoin-only edition at the same price for people who want the reduced surface.
Shift Crypto AG, Zurich, privately held. On 10 September 2026 attackers used an SSO flaw at Brevo to send two phishing campaigns from BitBox’s account and download its subscriber list (email addresses only); BitBox warned subscribers within an hour and disclosed the details publicly.
Reliable with good coverage of major assets. Narrower than Ledger, deliberately.
The friendliest setup of any fully open-source device here.
Strengths
- Open source with reproducible builds, and a secure chip
- Bitcoin-only edition available at the same price
- Easiest setup among the fully open devices
Against it
- Two severe firmware bugs fixed in August 2026 — keep firmware current
- Brevo breach (10 Sep 2026) put subscriber emails in phishers’ hands
- Narrower asset coverage and fewer integrations than Ledger
The sensible middle
BitBox02 is open source with reproducible builds and a secure chip, Swiss-made, and easier to set up than any other fully verifiable device here. It does less than Ledger and does it more transparently, which for most holders is the correct trade rather than a compromise. The Bitcoin-only edition at the same price strips the multi-chain code for people who do not need it.
2026 has not been quiet. The Dixence firmware update of 17 August 2026 fixed two severe bugs BitBox’s own audits found — one allowing code execution on an un-initialised Multi-edition device connected to a malicious host, one that could have sent silent-payment funds to an unintended address — and BitBox said a bootloader issue fixed in July was more serious than first described. None was reported exploited. On 10 September 2026 a flaw at newsletter provider Brevo let attackers send phishing from BitBox’s real account and take its subscriber list. BitBox disclosed each promptly. Keep firmware current and update only from the BitBoxApp.
Frequently asked questions
BitBox02 or Trezor Safe 5?+
Very close. Both are open source with secure elements and reproducible builds. Trezor has broader asset coverage and a colour touchscreen; BitBox02 has a Bitcoin-only edition at the same price and slightly simpler setup. BitBox fixed two severe firmware bugs in August 2026; Trezor’s support-portal breach was in January 2024. Either is a defensible choice.
Was BitBox affected by the Coldcard seed bug?+
No. BitBox mixes five entropy sources, including a per-device factory secret and input from the host, when it creates a seed. A seed originally generated on an affected Coldcard and imported into a BitBox is still at risk.
Is the BitBox phishing email real?+
On 10 September 2026 attackers used a flaw at BitBox’s newsletter provider Brevo to send two phishing campaigns from BitBox’s own account, claiming a fake security flaw. Because they came through the real sending infrastructure they passed authentication checks. BitBox never asks for recovery words; update firmware only inside the BitBoxApp or from bitbox.swiss.
Assessed by
Blockchain Security Researcher · September 27, 2026
◆ Disclosure
CoinRadar Daily is a non-commercial project. We have no commercial relationship with BitBox02, earn nothing from any link on this page, and carry no advertising or sponsorship anywhere on the site. Findings rest on public sources; we did not open an account or transact.
Rubric v2.0How we score →
The rest of the hardware wallets table
- 02BitBox02 — you are hereA simple, open, well-built device for people who want neither extreme8.2
Related tables
How we score →Independent, rubric-scored tables for the services behind this story.
Best Crypto Exchanges
Top rated: Kraken 8.4
Centralised venues that hold your funds while you trade.
6rated →
Best Crypto Staking Platforms
Top rated: Kraken Staking 8.0
Services that stake on your behalf.
5rated →