# BitBox02 Nova custody score: 89% | TradingAgentStack

> BitBox02 Nova by BitBox (Shift Crypto): custody score 89% from sourced facts on supply chain, key protection, signing, customer data and incidents.

Canonical: https://tradingagentstack.com/custody/bitbox/

1. [Home](https://tradingagentstack.com/)

2. [Custody](https://tradingagentstack.com/custody/)

3. BitBox02 Nova

# BitBox02 Nova: custody score 89%

BitBox (Shift Crypto) · Bitcoin-only or Multi · checked 2026-11-05. 76 of 85 points from sourced facts.

[Official store (shop.bitbox.swiss) →](https://shop.bitbox.swiss/)

## Score, input by input

| Input | What we found | Points | Source |
| --- | --- | --- | --- |
| Supply chain and authenticity Genuine-device check | In the app: The BitBoxApp runs an attestation check with a key certified at the factory, every time you connect. | 10/10 | [source](https://bitbox.swiss/bitbox02/security-features) |
| Supply chain and authenticity Official reseller list | Published: Official reseller list on bitbox.swiss (Where to buy). | 5/5 | [source](https://bitbox.swiss/buy/) |
| Supply chain and authenticity Tamper evidence | Seal or resistance: Packaging checks before setup; BitBox says they can't rule out every physical modification. | 3/5 | [source](https://support.bitbox.swiss/verifying-the-bitbox02-packaging) |
| Supply chain and authenticity Response to reseller incidents | No incident: None on record. | 5/5 | — |
| Key protection Secure element | Certified (EAL): Dual-chip design; the Nova's secure chip is EAL6+ certified. | 6/6 | [source](https://bitbox.swiss/bitbox02/) |
| Key protection Open firmware | Open, reproducible: Fully open-source firmware with reproducible builds. | 9/9 | [source](https://bitbox.swiss/bitbox02/security-features) |
| Signing safety Own screen to check what you sign | Yes: Transactions are verified on the device screen and confirmed by touch. | 15/15 | [source](https://www.iphonebutiken.se/files/bitbox02_datasheet.pdf) |
| Customer data exposure (36 months) Customer data | None found: No customer-data breach found for the last 36 months. | 15/15 | none found |
| Incident record (24 months) Security incidents | Flaw, no losses: Aug 17, 2026: firmware 9.26.5 fixed flaws BitBox called severe; no exploitation or losses reported. | 8/15 | [source](https://cointelegraph.com/news/bitbox-patches-severe-wallet-firmware-flaws) |

## Incidents

- **2026-08-17** Firmware 9.26.5 fixes severe flaws (memory corruption on unconfigured Multi devices; Silent Payments). No losses reported. [source](https://cointelegraph.com/news/bitbox-patches-severe-wallet-firmware-flaws)

## Where to buy safely

- Buy from the maker: [shop.bitbox.swiss](https://shop.bitbox.swiss/).

- Resellers: Official reseller list on bitbox.swiss (Where to buy). [source](https://bitbox.swiss/buy/) Its list names 61 shops in 32 countries (copied 2026-11-05); paste any shop into the [reseller check](https://tradingagentstack.com/custody/#reseller-check).

- On arrival: check the packaging, run the genuine-device check, and reject any device that already has a PIN or recovery phrase set.

## Keep it away from your bots

A hardware wallet is the vault. Don't connect it to a trading bot, an API key or an agent wallet: give the bot a separate trading float and sweep profits back to the vault's address. [How to split vault, float and sweeps](https://tradingagentstack.com/custody/#tiers). [Set up BitBox02 Nova as cold storage, step by step](https://tradingagentstack.com/cold-storage/).

## Questions

### Is BitBox02 Nova safe?

BitBox02 Nova scores 89% on our custody score (76 of 85 points from sourced facts, checked 2026-11-05). Weakest point: Aug 17, 2026: firmware 9.26.5 fixed flaws BitBox called severe; no exploitation or losses reported.

### Has BitBox (Shift Crypto) had a security incident?

Aug 17, 2026: firmware 9.26.5 fixed flaws BitBox called severe; no exploitation or losses reported.

### Where should I buy BitBox02 Nova?

From the maker's store (shop.bitbox.swiss). Resellers: Official reseller list on bitbox.swiss (Where to buy). On arrival, run the genuine-device check and reject any device that already has a PIN or recovery phrase set.

## Other hardware wallets, scored
[OneKey Pro: 94%](https://tradingagentstack.com/custody/onekey/)[Blockstream Jade Plus: 79%](https://tradingagentstack.com/custody/blockstream-jade/)[Trezor Safe 5: 78%](https://tradingagentstack.com/custody/trezor/)[CoolWallet Pro: 72%](https://tradingagentstack.com/custody/coolwallet/)[Foundation Passport Prime: 66%](https://tradingagentstack.com/custody/foundation-passport/)[Tangem Wallet: 66%](https://tradingagentstack.com/custody/tangem/)[Keystone 3 Pro: 54%](https://tradingagentstack.com/custody/keystone/)[Coldcard Q: 49%](https://tradingagentstack.com/custody/coldcard/)[Ledger Flex: 49%](https://tradingagentstack.com/custody/ledger/)

[All hardware wallets, scored](https://tradingagentstack.com/custody/) · [Is this seller authorized?](https://tradingagentstack.com/custody/#reseller-check) · [How we score](https://tradingagentstack.com/custody/#method)

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)