Devices such as USB sticks and SSDs use a type of technology called flash. A limitation of this type of technology is that flash cells (the individual elements that store data) can only undergo a limited number of write cycles, after which they wear out and cannot reliably store data. Put simply: every time you write data to the drive, you wear it out a little. There's another problem with this limitation, too - filesystems don't evenly write data across the whole disk, but instead write to certain locations (e.g. the file table) a whole bunch. This means that certain areas of the disk would be prone to premature wear, because of repeated writes.
Drives use a number of techniques in order to compensate for this aging limitation.
The first is overprovisioning, where the disk actually contains more flash cells than the advertised capacity of the disk. The idea is that worn-out flash cells can be detected and transparently replaced with others from the overprovisioned area, in order to improve the lifetime of the disk.
The second technique is wear-levelling, in which the logical disk blocks presented to the host system are randomly mapped to the actual physical cells in the device, and each new write goes to a random free cell. This causes the writes to be distributed across the cells, so they don't wear out so quickly. The actual implementation of this is a bit more complicated, but I'm keeping it simple for the sake of keeping this answer short.
Multi-pass wiping is never useful - all it does is waste time and wear out your devices. This is explained in detail in NIST SP 800-88 rev.1 (2014). The developer of the 35-pass method, Peter Gutmann, has stated many times that the technique was never intended to be used in practice - he goes as far as describing its use as a "voodoo incantation to banish evil spirits". The original justification for multi-pass wiping came from DoD 5220.22-M and other unclassified documents from the mid 2000s, which were largely based on paranoia rather than practicality. The newer NIST guidelines clarify this - you only ever need a single wipe pass.
Multi-pass wiping is particularly damaging to flash-based storage devices, because it causes multiple writes that wear out the disk. Even more importantly, simply overwriting the data from the OS does not overwrite any data in the overprovisioned slack space. This means any data you've written may have been copied to the overprovisioned cells, and will not be wiped.
Recovering data from overprovisioned (also known as "slack") space on the drive may be possible using only software, by sending certain commands to the drive. This is dependent on the specific make and model of drive. Hardware recovery should always be possible, by disassembling the device, desoldering the flash chips, and connecting them to a device that can read them directly. You should assume that this can be done.
Modern SSDs have a feature called Secure Erase to help work around these challenges. The storage controller on the drive contains a randomly selected key, which is used to transparently encrypt all data that gets written to the cells. When you send the drive a secure erase command, it discards the key and randomly picks a new one. This causes all of the data that was already written - even the data in the slack space - to become unreadable, because it is encrypted and the key is lost.
The Secure Erase feature is not usually available on USB sticks or other storage devices. In this case you should use full-disk encryption (FDE), such as BitLocker or VeraCrypt, from the moment you get the drive. This ensures that it is infeasible to recover data from the drive if you wipe it, because even if the attacker knows the disk unlock password it's unlikely that the disk encryption header (which contains values needed to decrypt any part of the disk) would be recoverable.