Skip to main content
CoinPulse
BitBox
Hardware wallet· founded 2015

BitBox Wallet: The Swiss Hardware Wallet Maker, Its Devices and Security Fixes

BitBox is a hardware wallet brand from Shift Crypto AG, a privately held company registered in the canton of Zurich and based in Adliswil, Switzerland 1. It sells two devices, the BitBox02 and the newer BitBox02 Nova. Each comes in a Multi edition for Bitcoin and selected other coins, or a Bitcoin-only edition with slimmer firmware. Both work with the free BitBoxApp 4. Like any hardware wallet, a BitBox keeps your private keys offline and signs transactions on the device, and Shift Crypto never holds your coins. One difference stands out: BitBox's default backup is a microSD card, though you can also write down recovery words 4. (This page is about the crypto wallet, not the retro game consoles or the Bitcoin ATM operator that share the name.)

Facts checked 10 cited sources No score on this page, no affiliate links

At a glance

Company
Shift Crypto AG, Adliswil, Switzerland (reg. CH-498.818.196) 1
Brand history
BitBox01 launched 2015; company rebranded to "BitBox" in 2023 13
CEO
Douglas Bakkum, co-founder 1
Devices
BitBox02 Nova and BitBox02, each in Multi or Bitcoin-only editions 4
Custody model
Self-custody: keys are generated and kept on the device
Backup
microSD card and/or written recovery words 4
Price (shop, Oct 23, 2026)
Nova $196; BitBox02 $167 6
Source code
Firmware and BitBoxApp published on GitHub (Apache-2.0) 7
Official site
bitbox.swiss
Last checked
October 23, 2026

Who makes BitBox

BitBox began in 2015 with the BitBox01, created by Douglas Bakkum and Jonas Schnelli. Bakkum is now CEO and a board member of Shift Crypto AG 1. A 2019 EU funding record lists the company under an earlier name, Shift Cryptosecurity AG. That record says the first-generation device had about 16,000 users in more than 100 countries at the time 2. In June 2023 the company moved its customer-facing branding to BitBox. Shift Crypto AG remains the legal entity that sells the devices and signs contracts 3.

Shift Crypto says the BitBox02 is designed and manufactured in Switzerland and that the company is privately held. It does not publish its investors 1.

Devices and editions

BitBox02 Nova BitBox02
Announced June 2025 5 2019 (succeeded BitBox01)
Secure chip Certified secure chip (EAL6+) in a dual-chip design 4 Microchip ATECC608B secure chip + ATSAMD51J20A microcontroller 4
Screen Glass OLED 4 128×64 white OLED 4
Connection USB-C, plus Bluetooth for iPhone/iPad (can be permanently disabled) 45 USB-C only 4
Backup microSD card or recovery words 4 microSD card or recovery words 4
Shop price $196 6 $167 6

The Multi edition supports Bitcoin, Litecoin, Ethereum, Cardano and, by BitBox's count, more than 1,500 ERC-20 tokens, and it adds universal two-factor (U2F) login 45. The Bitcoin-only edition strips out everything except Bitcoin. That means less code that could contain bugs, but you cannot add other coins later. The price is the same for both editions 6.

The Nova's Bluetooth link, called "Whisper", runs on a separate microcontroller from the signing chip and uses randomized addresses so the device is harder to track 5. If you do not need a phone connection, you can switch Bluetooth off permanently.

How a BitBox works

  1. Setup. You connect the device to the BitBoxApp on a computer or phone. The device generates your wallet keys itself. See our guide to setting up a hardware wallet.
  2. Backup. You save the backup to the included microSD card, write down the recovery words, or both 4. A microSD backup is fast and avoids writing errors. On the other hand, it is a digital file whose long-term readability depends on the card, so many users also keep a paper or metal copy. BitBox sells metal backup plates and spare cards separately 6.
  3. Daily use. The BitBoxApp shows balances and builds transactions, and you confirm each one on the device screen. The app can also connect to third-party wallet software.
  4. Recovery. If you lose the device, you restore from the microSD backup or your recovery words onto a new BitBox. Shift Crypto also publishes an offline tool for recovering BitBox02 backups 7.

Shift Crypto never needs your recovery words or microSD backup. Anyone who asks for them is attempting theft; see crypto phishing.

What BitBox costs

As of October 23, 2026, BitBox's official shop listed the BitBox02 Nova at $196 and the BitBox02 at $167, for either edition. Accessories are extra: a two-pack of microSD backup cards ($28), metal backup plates such as the Steelwallet ($73) and tamper-evident bags 6. The shop says import costs are covered and advertises 2–3 working-day UPS Express shipping to the US 6.

The BitBoxApp is free. Sending coins costs only the blockchain's network fee. Swaps or purchases arranged through partner services inside the app are priced by those partners.

Security model and disclosures

A BitBox protects keys in two ways. Keys stay on the device, and every transaction must be confirmed on the device's own screen, so malware on your computer cannot simply move your coins. Shift Crypto publishes the firmware and BitBoxApp source code on GitHub under the Apache-2.0 license, so outside researchers can review it 7. It also runs a bug bounty program, and several of the fixes listed below came from outside researchers through it 89.

What the design does not protect against: someone who gets your recovery words or microSD backup, phishing sites, and approving a transaction without checking the address on the screen.

How BitBox differs from similar wallets

BitBox's distinguishing features are its microSD backup, Swiss design and manufacturing, a Bitcoin-only edition at the same price as the Multi, and published firmware source code. Ledger uses a closed-source secure-element operating system and sells an optional ID-based recovery service. Trezor is also open source but relies on written recovery phrases. For CoinPulse's separate assessment, see CoinPulse's BitBox rating and evidence and the hardware wallet ratings.

Incident record

3 funds not affected

BitBox has no reported theft of user funds through its devices or infrastructure in the sources checked. The company has disclosed and patched several vulnerabilities:

SegWit excessive-fee attack

fixed June 3, 2020funds not affected
Researcher Saleem Rashid reported through BitBox's bug bounty that a malicious wallet app could trick a user into signing a SegWit transaction twice. With a miner's cooperation, the attacker could then extract excess fees. The issue was industry-wide and affected all SegWit-capable hardware wallets. BitBox shipped a firmware fix and said it had no reports of lost funds 8.
Outcome
Funds not affected.
Source: blog.bitbox.swiss

BitBox02 Nova secure-chip issues

fixed January 26, 2026 (firmware 9.25.0)funds not affected
Trezor's head of R&D, Andrew Kozlik, reported two issues via the bug bounty in October 2025. The more serious one could let an attacker with physical access and advanced equipment brute-force the device password, but doing so also erases the seed decryption key. It mattered only to users who reused the same password across several Nova devices. BitBox rated the impact minor to moderate and reported no lost funds 9.
Outcome
Funds not affected.
Source: blog.bitbox.swiss

"Severe" firmware flaws

disclosed August 2026 (fixed in firmware 9.26.5)funds not affected
BitBox disclosed two flaws. The first was a memory-corruption bug on Multi-edition BitBox02 and Nova devices not yet set up with a wallet, which a malicious host computer could use to run code and potentially install malicious firmware. The second was a Silent Payments flaw that could lock bitcoin to an unintended address, which an attacker could then use to demand a ransom. BitBox said it had no reports of either being exploited and urged all users to update 10.
Outcome
Funds not affected (no exploitation reported).
Source: cointelegraph.com

Hacks in DefiLlama’s public database are also scored as the security record on the BitBox rating page.

Questions about BitBox

Is BitBox the same company as Shift Crypto?
Yes. Shift Crypto AG is the legal company, and BitBox has been its customer-facing brand since June 2023 13.
Do I have to use the microSD card?
No. You can back up to the microSD card, write down recovery words, or do both 4.
Should I pick the Multi or the Bitcoin-only edition?
The Bitcoin-only edition runs less code and supports only BTC. The Multi edition adds Ethereum, ERC-20 tokens, Litecoin, Cardano and U2F login. Both cost the same 46.
Does the BitBox02 Nova have Bluetooth?
Yes, for iPhone and iPad connections, on a separate chip from signing. It can be permanently disabled. The original BitBox02 is USB-C only 45.
Is "BitBox Bitcoin ATM" part of this company?
No evidence links them. The BitBox hardware wallet comes from Shift Crypto AG in Switzerland, and the Bitcoin ATM network is a separate business that shares the name.

BitBox elsewhere on CoinPulse

Sources

  1. 1Shift Crypto — About.shiftcrypto.ch
  2. 2European Commission CORDIS — Project 855049 (Shift Cryptosecurity AG, 2019).cordis.europa.eu
  3. 3No BS Bitcoin — BitBox App v4.37.1 released, Shift Crypto rebranded to BitBox (2023-06-21).nobsbitcoin.com
  4. 4BitBox — BitBox02 and BitBox02 Nova.bitbox.swiss
  5. 5Bitcoin Magazine — BitBox announces BitBox02 Nova (2025-06-20).bitcoinmagazine.com
  6. 6BitBox Shop.shop.bitbox.swiss
  7. 7BitBoxSwiss on GitHub.github.com
  8. 8BitBox Blog — BitBoxApp and firmware update 6/2020 (2020-06-03).blog.bitbox.swiss
  9. 9BitBox Blog — BitBox 01.2026 "Marmorera" update (2026-01-26).blog.bitbox.swiss
  10. 10Cointelegraph — BitBox patches "severe" wallet firmware flaws (2026-08-18).cointelegraph.com

Other hardware walletsAll →

What changed on this page

  • 2026-10-23Profile created.
All companies