The clear vacuum-sealed bag helps reveal obvious interference before first use. Shipping can damage the outer parcel or cause the bag to lose some vacuum; neither condition alone means the packaging was tampered with. The bag and its sealed edges should remain intact, with no cuts, punctures, tears, opened seams, or signs of resealing.

Check the outer parcel first, then inspect the bag before opening it. Because packaging cannot prove device authenticity, connect the BitBox02 to the official BitBoxApp for the automatic Attestation Check if the bag is intact. If anything is missing, the bag appears altered, or the app shows an authenticity warning, stop and contact BitBox Support.

Check the outer shipping parcel

The shipping box or envelope protects the product during delivery. It may arrive dented, crushed, torn, or partly opened because of handling in transit. Damage to this outer parcel does not by itself show that the BitBox02 or its vacuum bag was tampered with.

Check that the expected contents are present, then inspect the clear vacuum bag inside. If anything is missing or damage to the outer parcel also affects the vacuum bag, do not use the device and contact BitBox Support.

Check the vacuum-sealed bag

Your BitBox02 arrives inside a clear plastic bag with sealed edges. Check the following:

• Gray edge pattern: A distinctive gray pattern should run continuously around all four sealed edges. Its exact position may vary slightly between bags.
• Bag and seams: The plastic and sealed edges should have no cuts, punctures, tears, opened seams, or signs that the bag was resealed.

Reference images

These images show the clear vacuum bag and its characteristic gray-patterned seal on different BitBox02 editions. The amount of air inside the bag can vary, so use the images to identify the packaging and sealed edges rather than to judge how tightly the plastic fits around the inner box.

Vacuum bag and gray-patterned seal	BitBox02 Multi edition
BitBox02 Nova Bitcoin-only edition	BitBox02 Bitcoin-only edition

If the vacuum bag is loose but intact

The bag can lose some vacuum during shipping and may no longer fit tightly around the inner box. A looser bag or a small amount of air is acceptable when the bag and all sealed edges are intact and show no signs of opening or resealing. Continue to the Attestation Check in the official BitBoxApp.

If the packaging looks cut, opened, or resealed

Do not open or connect the BitBox02 if the bag has a cut, puncture, tear, opened seam, interrupted seal, or signs of resealing. If you already opened the bag or connected the device, do not continue with setup or transfer funds to it.

Contact BitBox Support before using the device.

Verify device authenticity in the BitBoxApp

Packaging can reveal obvious interference, but it cannot prove that a device is authentic. Complete the definitive authenticity check using the official BitBoxApp.

1. Open the official BitBoxApp.
2. Connect your BitBox02.
3. The BitBoxApp automatically performs the Attestation Check before the device is unlocked.

During this check, the BitBoxApp sends a random challenge to the BitBox02. The device signs it with an attestation key protected by its secure chip, and the app verifies the signed response against a certificate signed by Shift Crypto.

The Attestation Check is successful when the BitBoxApp completes the automatic check without displaying an authenticity warning. You can then set up your BitBox02 with a microSD card backup.

For more detail about this protection, read How we mitigate supply chain attacks.

Contact BitBox Support if you are unsure

If you cannot determine whether the bag or its sealed edges are intact, do not continue with setup. Contact BitBox Support and include:

• your order number or the place of purchase;
• clear photographs of the complete bag and the area that concerns you;
• whether the bag was opened or the BitBox02 was connected; and
• a screenshot of any authenticity warning shown by the BitBoxApp.

Do not include recovery words, a wallet backup, private keys, passwords, passphrases, PINs, or authentication codes.