CertiK Finds Out-of-Bounds Write Vulnerability in BitBox02 Hardware Wallet

• CertiK found an out-of-bounds write flaw in BitBox02’s USB HID communication.
• BitBox fixed the issue in its July Oeschinen security update after CertiK reported the vulnerability.

Web3 security firm CertiK has identified an out-of-bounds (OOB) write vulnerability in the BitBox02 hardware wallet. BitBox disclosed and fixed the issue in its July Oeschinen security update, crediting CertiK researcher Guanxing Wen for reporting the vulnerability.

The issue highlights that hardware wallet security extends beyond keeping private keys isolated from connected devices. Wallets also need to securely process external commands, firmware updates and transaction data before approving a signature.

Vulnerability Found in Host-Device Communication

According to the disclosure, the vulnerability affected how the BitBox02 firmware handled a specific USB HID control request. The firmware accepted a length value controlled by the connected host without checking it against the size of the destination buffer.

A specially crafted request could therefore cause data to be written outside the intended memory area, potentially leading to a control-flow hijack. The finding shows how an attacker could target the communication path between a hardware wallet and a connected computer or smartphone, even though the private key itself remains on the device.

The issue is not the first hardware wallet security finding involving the researcher. Ledger also disclosed a vulnerability in January 2026 that Guanxing Wen identified through its bug bounty program. The issue affected the MCU firmware update process and involved insufficient validation of a host-provided reset_handler address. Ledger fixed the vulnerability and said user funds were not at risk.

The two vulnerabilities affected different components, but both demonstrate the importance of securing the wider environment around a hardware wallet, including communication protocols, firmware and boot processes.

CertiK’s Hack3D H1 2026 report recorded 344 Web3 security incidents and more than $1.31 billion in losses during the first half of 2026. Wallet compromises accounted for more than $444 million across 33 incidents, making them the most financially damaging attack category during the period.

For users, keeping wallet firmware updated and downloading companion applications only from official sources remain important security measures. Checking transaction details directly on the device also helps ensure that the transaction being signed matches what the user intended to approve.