BitBox Wallet Flaw Exposes Weakness Beyond Private Key Isolation

The security of hardware wallets has been called into question after Web3 security firm CertiK discovered a severe out-of-bounds (OOB) write vulnerability in the BitBox02 wallet.

The flaw, which was patched in July's Oeschinen security update, allowed an attacker to hijack control of the device by sending an oversized command over USB.

CertiK researcher Guanxing Wen identified the issue, which sat not in the storage of private keys but in how the device communicated with a computer. The wallet's software blindly accepted instructions about data without checking if it would fit into its temporary memory space.

This is not an isolated incident, as Ledger patched a similar flaw earlier this year after CertiK uncovered that host-provided reset handlers were not properly validated during firmware updates.