CertiK has flagged a major security blind spot in crypto cold storage. The blockchain cybersecurity firm discovered an out-of-bounds write flaw inside the BitBox02 device, showing how malicio
CertiK has flagged a major security blind spot in crypto cold storage. The blockchain cybersecurity firm discovered an out-of-bounds write flaw inside the BitBox02 device, showing how malicious commands sent through an infected PC can bypass typical hardware protections.
The discovery challenges a core industry assumption: keeping private keys physically offline is not enough if the device fails to screen what comes through the USB port.
The vulnerability sat directly inside the device's communication handler. When a user connects the BitBox02 to a computer, it processes standard USB Human Interface Device (HID) requests.
CertiK researcher Guanxing Wen found that the wallet’s firmware blindly accepted data length values dictated by the host computer. It never checked those numbers against its internal memory bounds. Because of that oversight, an attacker on the connected PC could send a crafted payload, overwrite adjacent memory, and hijack execution flow.
BitBox rolled out a fix in its July "Oeschinen" firmware release after CertiK shared its findings, preventing live exploits in the wild.
This discovery coincides with record-setting theft figures tracked by CertiK. In its Hack3D report covering the first half of 2026, the firm documented $1.31 billion in total losses across 344 security incidents.
Custody breaches caused the most damage. Just 33 wallet incidents accounted for over $444 million in losses, making private key and signing compromise the single most destructive vector in Web3. For both everyday users and institutional custodians, the research proves that risk extends far beyond the physical wallet chip to desktop apps, drivers, and bridge cables.
BitBox is not the only manufacturer CertiK has put under the microscope. Earlier, Wen uncovered CVE-2025-15645 in Ledger devices, where the bootloader failed to properly validate reset handler addresses during firmware updates. Ledger patched the bug without any loss of user funds.
Brands like Ledger, Trezor, and BitBox often compete on proprietary chips and open-source architecture. Yet CertiK's ongoing disclosures demonstrate that attackers rarely bother attacking the ultra-secure silicon directly; they target the softer code running USB ports, boot sequences, and companion software.
Most crypto security audits still focus heavily on smart contracts. CertiK's research demonstrates why firms must look closer at the full transaction pipeline.
Attackers do not need to crack cryptographic keys if they can manipulate device memory while a transaction is signed. As billions in institutional capital enter tokenized markets, auditors must evaluate companion apps, host APIs, and device firmware as a unified system.
CertiK's work on the BitBox02 proves that hardware isolation cannot protect funds on its own. While cold wallets remain the strongest barrier against remote hackers, users still need to update firmware immediately and verify every single transaction detail on the physical screen before confirming. Complete security requires locking down every wire, bridge, and memory buffer along the way.
