Bitcoin multisig hardware wallet maker Frostsnap released version 0.4.0 on Aug. 27, fixing two disclosed security issues and urging users to update both the app and device firmware. The team said it has not found any user fund losses so far. The first issue, tracked as FSA-2026-001, involved malicious signing requests that could mark an output as belonging to the user’s wallet. Because the device did not verify that claim and did not show it on the confirmation screen, funds could potentially be sent to an address the user had never seen. The second issue, FSA-2026-002, affected change addresses that could fall outside the wallet recovery scan range. After a backup restore, users might see funds shown as missing even though the assets remained in the wallet. Following the update, the app will prompt users to upgrade device firmware and now includes downgrade protection for firmware.
Bitcoin multisig hardware wallet Frostsnap released v0.4.0 on Aug. 27, patching two security issues. The team said it has not identified any loss of user funds.
Details of the two fixes
The first issue, FSA-2026-001, involved malicious signing requests that could mark an output as "belonging to the user’s wallet." Frostsnap said the device did not verify that claim and did not display it on the confirmation screen. That created a risk that funds could be sent to an address the user had never seen.
The second issue, FSA-2026-002, involved change addresses. According to the team, a change address could fall outside the wallet recovery scan range. After restoring from a backup, the wallet could show funds as missing even though the assets were still in the wallet.
What changes in v0.4.0
After the update, the app will prompt users to upgrade device firmware. Frostsnap also added firmware downgrade protection and advised users to update the app and firmware as soon as possible.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
