BitBox02

What is the BitBox02?

The BitBox02 is a hardware walletGlossaryHardware walletA small dedicated device that keeps your private keys offline and signs transactions internally. The key never leaves the device, so malware on your computer can’t get at it.On the learning path: Stage 6 · Step 1 – Hardware wallets compared →In the glossary →× from the Swiss company Shift Crypto AG, which presents itself to the public as BitBox.^[1] It generates and stores your private keys offline and signs transactions on the device.

• Two editions: ‘Multi’ for several crypto assets and ‘Bitcoin-only’. The edition is fixed at the factory; the bootloader prevents switching.^[2] The Bitcoin-only edition contains less code and so offers a smaller attack surface.^[3] We only explain using it with Bitcoin.
• BitBox02 Nova: available since June 2025, with an EAL6+-certified secure chip and – unlike the original BitBox02 – usable with iPhone and iPad via Bluetooth.^[4]
• Software: the BitBoxApp guides you through setup and is available in many languages, including English and German.^[5] The device also works with SparrowProvider · Software walletSparrow WalletBitcoin desktop wallet with no purchase price and full transparency: coin control, PSBT, multisig and support for most hardware wallets.Non-custodial software – no financial licence required · reviewed Sept 2026Price: no purchase price (donations welcome); network fee when sending (as of Sept 2026)On the learning path: Stage 5 · Step 2 – Setting up your first wallet →Our profile →Official website ↗×, Electrum, NunchukProvider · Software walletNunchukMultisig wallet for smartphone and desktop – no subscription if you do it yourself, subscriptions for assisted multisig and inheritance.Non-custodial software – no financial licence required · reviewed Sept 2026Price: Basic version $0; subscriptions $120 to $2,100 a year (as of Sept 2026)On the learning path: Stage 5 · Step 2 – Setting up your first wallet →Our profile →Official website ↗× and other Bitcoin wallets.^[6]

Costs

You pay for the device once; there are no ongoing fees for storage, and transactions only cost the network fee. The official shop shows the current price for each model and edition. Orders within the EU are shipped from a warehouse in Germany, so no import duties are charged. For other destinations, the checkout shows whether duties and taxes are included; if they are not, the carrier may ask you to pay them before delivery (as of September 2026).^[7]

Security and backup

The BitBox02 combines a secure chipGlossarySecure element (security chip)A chip specially hardened against physical attacks, like the ones in bank cards and passports. In many hardware wallets it protects the PIN and secrets if the device falls into the wrong hands.On the learning path: Stage 6 · Step 1 – Hardware wallets compared →In the glossary →×, which hardens the device against physical attacks, with fully open-source firmware.^[1] The firmware builds are reproducible: independent reviewers can check whether the published firmware was built from the open code.^[8]

In August 2026, firmware 9.26.5 closed two serious flaws that BitBox found internally: one in the Multi edition before setup on a compromised computer (the Bitcoin-only firmware doesn’t contain this code) and one in payments to silent-payment addresses, where funds could be locked to an unintended address. BitBox also rated a flaw in the older BitBox02, already fixed in firmware 9.26.2, as serious; it required successful phishing. No stolen funds are known, and existing seeds are not affected. So install firmware updates promptly via the BitBoxApp.^[10]

You store the backup on a microSD card, or you write down the recovery words – your seed phraseGlossarySeed phrase (recovery phrase)A sequence of usually 12 or 24 words from which your wallet derives all its private keys. Anyone who knows the words has full access to your bitcoin – so they belong in an offline backup and never in anyone else’s hands.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →×. The microSD backup is not encrypted: anyone who has the card can restore your wallet. Keep it as safe as a seed phrase, separate from the device, and never insert it into any device other than the BitBox02.^[9] How to keep a backup safe for the long term is explained in Backing up your seed phrase.

Privacy and phishing

A hardware wallet protects your keys, not your contact details. Twice, email service providers used by BitBox have been hit; according to BitBox, the devices and the BitBoxApp were not affected either time:

• July 2022: at the marketing service ActiveCampaign, unknown attackers stole names, email addresses and IP addresses of newsletter subscribers and customers. Delivery addresses were not stored there.^[11]
• September 2026: through a vulnerability at the newsletter service Brevo, attackers got into BitBox’s account and sent phishingGlossaryPhishingFraud using fake emails, text messages, websites or calls that look like genuine exchanges, wallet makers or banks. The goal is your passwords, 2FA codes – and above all your seed phrase.On the learning path: Stage 6 · Step 2 – Spotting scams →In the glossary →× emails to subscribers, whose email addresses are considered exposed. The emails looked genuine and led to a website that asked for the recovery words.^[12]

BitBox never asks for your recovery words. Never enter them on a website, in an app or in an email.

• Only buy from the official shop or authorised resellers.
• If you can, use a separate email address (such as an alias) and a parcel locker or pick-up point.
• Always generate the seed phrase yourself on the device.

More on this in Privacy with Bitcoin; Setting up a hardware wallet walks you through the setup step by step.