BitBox02
Review and Comments 2023

BitBox02 Review 2023

BitBox02 is the second hardware wallet from the Swiss company Shift Cryptosecurity AG. This time there are two editions that share the same hardware but differ by the software. One edition provides support for different cryptocurrencies while the other minimizes the attack surface and only supports Bitcoin.

First Impression

Both editions of the hardware wallet Bitbox02 can currently be ordered at a price of 109,00 € (click here to check the current price) directly from the manufacturer.

Bitbox02 is available in two editions

The difference lies only in the software. In addition to Bitcoin, the Multi Edition also supports other, more well-known cryptocurrencies such as Ethereum or Litecoin. It is also possible to use the Multi edition for universal 2-factor authentication. U2F provides the ability to securely log in to online accounts using BitBox02 as a physical security key. This is deliberately missing from the Bitcoin-only edition, because they want to keep the attack surface for hackers as low as possible.

Scope of Delivery

The carton is shipped in a plastic bag welded in. You should check beforehand whether it is intact and does not appear to be damaged. If the vacuum bag is damaged or cut open, looks different or the grey pattern is missing on one of the four sides, you should not use the device and contact the manufacturer.

Bitbox02 Scope of delivery

The BitBox02 is shipped with extensive accessories. In addition to the hardware wallet itself, it includes an 8GB microSD card, a USB-C to A adapter, a USB-C extension cable, tapes for the hardware wallet and a quick start guide with stickers. Everything was really thought of here, so that you can start directly.

Bitbox02 Front View

with the display switched on

microSD Cards Slot

The Digital Bitbox looks like a small, inconspicuous USB stick with USB-C port with a size of 45x24x8 millimeters. On both sides there is a small Digital Bitbox logo and on the bottom there is an eyelet for the ribbon and a slot for a microSD card. Touch sensors are hidden on both sides, which react to typing, swiping and holding gestures.

Set up BitBox02

As described in the Quick Start Guide, you first download the BitBox app. These can be found on shiftcrypto.ch/start for all common operating systems. Now you insert the microSD card into the BitBox02 and connect it to the computer or smartphone on which the BitBox app is installed. Then simply follow the instructions of the software and perform the setup. This includes an update of the firmware and later also the setting of a device password. You can create a new account or import an existing one. The latter is quick and easy if the account has previously been created with a BitBox and the backup is on the SD card. But also accounts of external hardware wallets can of course be restored.

After creating an account, a backup is automatically saved on the SD card. After backup, it is recommended to keep the micro-SD card separate from the BitBox, unless you want to manage the backups. It is important to store the SD card securely, as the backup is not protected by a password. This gives everyone with access to the SD card also access to the cryptocurrencies Later you can also display the recovery key in the form of 24 words in the settings.

Because you don’t necessarily have to write down the backup yourself, but it is stored on the SD card, the setup is really quick and convenient. Also the easy handling makes the process easy.

Handling

Controlling the BitBox02

The touch gestures are intuitive

The control of the BitBox02 has been fundamentally revised. For example, there is no longer just a touch button like its predecessor, but five sensors on each side that react to touch. This allows you to use typing, swiping and holding gestures to type words or sign transactions. Feedback is displayed directly on the integrated display. The touch gestures work very reliably and are really fun with the hardware wallet The display always remains clearly visible and the visual feedback fits perfectly with the gestures.

Handling the BitBox app

The software has also been fundamentally revised and is now the new standard for both the predecessor BitBox01 and BitBox02.

Each page of the BitBox app has its own help section

The software is clear and well structured. For each page there is a help area that you can open. This provides answers to the most frequently asked questions specifically for the current screen.

There are also additional features for experienced users. For example, it is possible to activate Coin Control. This adds a privacy-enhancing feature by choosing which unspent transaction spending (UTXO) you want to use for a transaction. Other features such as TOR support, your own full-node support or the selection of Bitcoin/Litecoin transaction formats (Legacy, Segwit, Bech32) are added. The MultiSig option no longer exists.

Compatibility

The BitBox02 can be used on all major operating systems:

• Windows
• Linux
• Mac
• Android

Since not all PCs have USB-C ports yet, an adapter is included. Mobile use is also planned, for Android the version is currently still in beta.

The following cryptocurrencies are currently supported by the Multi Edition, with continuous work on further coins:

• Bitcoin
• Cardano
• Ethereum
• Litecoin
• ERC-20 Tokens

Documentation and Support

The BitBox02 comes with a quick start guide that explains the first steps of setup and the gestures of touch control. In addition, there is an extra help sectionfor all products from Shift Cryptosecurity AG, which leads one step by step through all topics. Everything is explained, from unpacking and setup to the exact functions and, if necessary, with videos and screenshots. All articles are written in English.

However, if a question remains unanswered, there is a contact form in the help section or you can also reach the team by e-mail.

Security

Shiftcrypto itself says that they have developed both the hardware and firmware of the BitBox02 from scratch, based on all the insights they have gained from the BitBox01.

Security features include securely verifying transactions, receiving addresses, and other data on the built-in screen by acknowledging gestures (tap, swiping, and holding). The password is also entered directly on the device instead of in the BitBoxApp. You no longer have to pair a smartphone with the hardware wallet like the BitBox01 to see what you’re actually signing.

To avoid brute force attacks, a monotonous counter in the secure chip limits the total number of attempts on device password inputs. The BitBox02 only accepts firmware signed by Shift Cryptosecurity. The boot loader prevents firmware downgrades and the installation of firmware for another output of BitBox02 (multi or bitcoin only). The encrypted seed is stored on the microcontroller unit (MCU), which is protected by both the secure chip and the device password chosen by the user. The BitBox02 uses multiple entropy sources to generate the seed.

The firmware of the BitBox02 is open source. Each device is authenticated at the factory setup, and the BitBoxApp checks the authenticity of your device each time. USB communication between the app and the device is encrypted to protect against malicious USB cables and software stacks.

In the BitBox02 threat model the company discloses in detail what attack options exist and what measures they have taken against it.