Firmware updates for hardware wallets: how often and why

How often BitBox released firmware in the past year and which releases fixed security flaws, how to check an update, and what to do before and after updating.

Key points

Hardware wallets need updates too: they fix flaws and add support for new coins and features.
BitBox released 9 firmware versions between November 2025 and November 2026. Two of them name security fixes in their notes.
Update only through the maker’s own app, and have your recovery words at hand before you start.

Why a wallet needs updates

The firmware on the device is code like any other, and code has flaws. Updates fix them, and they add support for new coins, new kinds of transactions, and clearer screens. A device that is never updated keeps every flaw ever found in its version.

BitBox’s releases in one year

BitBox publishes every firmware release on GitHub. This archive read the list on November 12, 2026:

Version	Date	What the notes say about security
9.27.1	August 31, 2026	no security fix named; shows the message type of Ethereum EIP-712 signatures before signing
9.27.0	August 24, 2026	pre-release, no security fix named
9.26.5	August 17, 2026	“Security improvements”
9.26.4	July 9, 2026	no security fix named
9.26.3	July 8, 2026	“Fixed potential out of bounds write,” and further security improvements
9.26.2	July 8, 2026	intermediate release that updates the bootloader
9.26.1	April 19, 2026	no security fix named
9.25.1	January 27, 2026	fix for the simulator only
9.25.0	January 21, 2026	no security fix named

Some releases depend on each other: according to the notes, a device on version 9.26.1 or older first has to install 9.26.2.

Ledger

Ledger publishes its firmware notes on its support website. This archive could not read that page automatically on November 12, 2026, so this guide has no figures for Ledger yet. Ledger’s app shows when an update is available for your device.

How an update is checked

BitBox lists for every release how to rebuild the firmware from its published code and which hash the device shows at startup after the update. If the hash on your device matches the one in the release notes, you run the published code.

What you can do

Have your recovery words at hand before you start, in case something goes wrong during the update.
Update only through the maker’s own app. Never install a firmware file that someone sends you or that a website offers.
Read the release notes, and update soon when they name a security fix.
Check the hash the device shows after the update, if your maker publishes one.
Make sure the wallet opens with the same accounts and balances afterward.

Next step

The guide Open source or closed explains why reproducible builds make an update checkable.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.