Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input seed, resulting in only four billion possible mnemonics. The affected versions of the browser extension are 0.0.172 through 0.0.182. To steal funds efficiently, an attacker can identify all Ethereum addresses created since the 0.0.172 release, and check whether they are Ethereum addresses that could have been created by this extension. To respond to the risk, affected users need to upgrade the product version and also move funds to a new wallet address.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-31 | 1 | General1 |
| 2026-08-08 | 1 | General1 |
| 2026-08-31 | 2 | PoC2 |
• installing an official Trust Wallet browser extension https://nvd.nist.gov/vuln/detail/CVE-2023-31290 • installing an official Trust Wallet iOS app https://nvd.nist.gov/vuln/detail/CVE-2024-23660 8/13
Post summary
The text simply lists two CVE entries with links to NVD pages, providing no further details on exploitation, patches, or technical aspects.
Just open-sourced a BTC wallet cracking POC toolkit covering most publicly known vulnerabilities: - Coldcard Yasmarang — reproducing the $116M hack - TrustWallet — CVE-2023-31290 / CVE-2024-23660 - Libbitcoin Milk Sad — $900K+ stolen - CryptoJS Blockchain info — $5M+ stolen - Coldcard Dice — still unpatched, never publicly disclosed Your average home PC can join the game. With CUDA acceleration: 50,000 mnemonics/private keys per second. GitHub took down my repo. Again. I rebuilt. Again. New home: https://github.com/easyHvckCash/easyWallet More POCs coming soon. Stay tuned. 🔓
Post summary
The user has published a proof-of-concept BTC wallet cracking toolkit that includes exploit code for several high‑profile CVEs, reports ongoing exploitation with significant theft amounts, and provides a GitHub repository for the code.
开源了一套 BTC 钱包破解 POC 工具集，涵盖了目前已知的大部分公开漏洞： - Coldcard Yasmarang — 复现 1.16 亿美元攻击 - TrustWallet — CVE-2023-31290 / CVE-2024-23660 - Libbitcoin Milk Sad — 超 90 万美元被盗 - CryptoJS Blockchain info — 超 500 万美元被盗 - Coldcard Dice — 至今未修复，从未公开披露 普通家用电脑即可参与。CUDA 加速下可达每秒 5 万个助记词/私钥的扫描速度。 GitHub 封了我的仓库。又一次。我重建了。又一次。新地址：https://github.com/easyHvckCash/easyWallet 更多 POC 持续更新中，敬请关注。🔓
Post summary
该条目宣布一套开源 BTC 钱包破解 PoC 工具集，包含多个 CVE 的利用代码，强调可通过 GPU 加速扫描，但未报告现行活跃攻击或补丁信息。
@nicogsobrino Si han tenido. Trust wallet por ejemplo https://mallory.ai/vulnerabilities/CVE-2023-31290
Post summary
The user mentions a Trust Wallet CVE (CVE‑2023‑31290) and links to a webpage, but provides no additional details, claims of exploitation, or mitigation information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | trustwallet | trust_wallet_browser_extension | - | - | - |
| App | trustwallet | trust_wallet_core | - | - | - |