USB buffer overflow in the Cypherock X1 shown to expose keys to malware on the computer
Who is affected
Cypherock X1 owners on firmware older than v0.6.1024 who connected and used the wallet on a computer running malware could have had their keys or passphrase read out over USB, according to the researcher. Cypherock has not published a statement on the disclosure.
What happened
On 10 October 2025 independent researcher Sergei Volokitin (Hexplot) presented “Breaking the Vault: USB Bugs and Bug Bounty Failures” at the Hexacon conference in Paris. According to the talk abstract, an out-of-bounds write in the USB packet processing logic of the Cypherock X1 leads to a full compromise of the device, and a malicious USB payload can extract the user’s private keys while they interact with the wallet. The abstract says a live proof of concept showed how malware on a user’s PC can steal funds.
According to RandoriSec’s report on the talk, the flaw is a buffer overflow in the USB packet parsing code that handles communication between the device and the desktop application, found by reading the X1’s open-source firmware. RandoriSec writes that Volokitin used it to dump the passphrase from the wallet, and that he also disclosed other bugs, notably in the device’s NFC stack.
RandoriSec reports that Volokitin submitted the issue through Cypherock’s bug bounty programme on 4 November, received no response for an extended period, and was then told by Cypherock that the company already knew about the vulnerability and offered a bounty RandoriSec describes as small. The talk pointed out that a fix was pushed to Cypherock’s public GitHub repository the next day. That commit, titled “Buffer overflow fix” and dated 5 November 2024, adds a check of the remaining I/O buffer size before incoming USB data is copied. The first tagged firmware release on GitHub that contains it is v0.6.1024, published on 7 November 2024.
No public statement from Cypherock about the talk was found.
A private key is the secret number that proves ownership of a crypto address and signs its transactions. Whoever has it controls the funds.
Malware is malicious software that steals or redirects crypto, for example by logging keystrokes, swapping copied addresses or reading wallet files.
Read full definitionOpen Source Firmware refers to firmware in hardware devices, like wallets, where the source code is publicly available, allowing transparency, auditability, and customization.
Read full definitionA passphrase is an additional security layer for cryptocurrency wallets, acting as a 25th word in the BIP39 seed phrase, protecting access to hidden wallets.
Read full definitionNFC Connectivity in cryptocurrency enables contactless transactions using near-field communication, allowing users to sign or authorize actions by tapping their device to a reader.
Read full definitionFirmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionSources
Independent reporting and research this entry was checked against.
- Hexacon — Breaking the Vault: USB Bugs and Bug Bounty Failures, Sergei Volokitin (talk abstract, 10 Oct 2025)
- RandoriSec — [CONFERENCE] Hexacon 2025 (22 Oct 2025)
- GitHub (Cypherock/x1_wallet_firmware) — fix: Buffer overflow fix (5 Nov 2024)
- GitHub (Cypherock/x1_wallet_firmware) — Release v0.6.1024 (7 Nov 2024)
Learn more
Guides on protecting yourself against this type of incident (Firmware vulnerability) and the glossary terms that describe it.
Can Hardware Wallets Be Hacked?
Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.
Read GuideIs a Hardware Wallet Really Safe?
Hardware wallets are the safest option for most people — but you can still make mistakes. Here's what to know.
Read GuideFirmware
Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Bootloader
A bootloader is a small program that initializes hardware and loads the main operating system or firmware on a device, often used in blockchain hardware wallets for secure startup.
Firmware Update
Firmware Update installs new low-level software on a hardware wallet to fix bugs, enhance security, or add features in cryptocurrency devices.
Cite this entry
WalletInsights. “USB buffer overflow in the Cypherock X1 shown to expose keys to malware on the computer”. Hardware wallet security incident tracker. Last verified November 4, 2026. https://walletinsights.io/en/security-incidents/cypherock-x1-usb-buffer-overflow-hexacon-2025/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.