Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-30 | 1 | General1 |
| 2026-02-11 | 1 | Active Exploitation1 |
| 2026-07-29 | 1 | General1 |
| 2026-07-31 | 1 | General1 |
| 2026-08-01 | 1 | General1 |
| 2026-08-02 | 1 | General1 |
| 2026-08-03 | 2 | General2 |
| 2026-08-05 | 1 | Disclosure1 |
| 2026-08-09 | 1 | Active Exploitation1 |
| 2026-08-10 | 1 | General1 |
| 2026-08-26 | 1 | General1 |
Full details here: https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
Post summary
The content merely points to a GitHub wiki page for CVE-2023-39910 without providing any further detail on the vulnerability, PoC, exploitation, or remediation.
@PeterRizun This client-server (ZMQ) certificate generator warning is also in bx: "WARNING: entropy is obtained from the underlying platform." Guess what Bitcoin wallet accepts wallet seed entropy from the underlying platform. https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910 https://t.co/QTjr8HEN8r
Post summary
The tweet highlights CVE-2023-39910 by noting how both the client‑server certificate generator and the Bitcoin wallet rely on platform entropy, but it provides no PoC, exploit code, patch, or evidence of active exploitation.
Ahh I remebered it sorta right.. CVE-2023-39910) in Libbitcoin Explorer
Post summary
The text merely notes the presence of CVE‑2023‑39910 in Libbitcoin Explorer without sharing any further context, evidence of exploitation, or remediation steps.
Bitcoin’s cryptographic security isn’t just about whether secp256k1 is “broken.” Recent vulnerabilities show risks across the entire stack: • CVE-2024-49364 — private-key extraction • CVE-2024-48930 — ECDH private-key extraction • CVE-2023-49292 — private-key recovery • CVE-2023-39910 — weak wallet entropy • CVE-2021-38195 — invalid signature acceptance • CVE-2019-25003 — timing side channel CVE-2023-39910 (Milk Sad) was exploited in the wild, enabling recovery of vulnerable wallet private keys and theft of funds. August 2026 adds another warning: a Coldcard wallet flaw was linked to coordinated attacks reportedly draining nearly $89M from 1,000+ Bitcoin wallets. And vulnerabilities don’t always have CVEs. Reused/predictable ECDSA nonces, RNG failures, invalid-curve attacks, side channels, firmware bugs and supply-chain compromises can all threaten private keys. Bitcoin also relies on Schnorr signatures through BIP-340 and Taproot (BIP-341/342), not just ECDSA. Then there’s the long-term threat: quantum computers could eventually break the elliptic-curve cryptography securing Bitcoin. The risk isn’t that secp256k1 has suddenly been cracked. The risk is the entire security stack. Bitcoin needs continuous cryptographic auditing, secure randomness and nonce generation, hardened implementations, responsible disclosure, and a credible post-quantum migration path — before the threat becomes urgent.
Post summary
The post enumerates several Bitcoin CVEs, emphasizing that CVE-2023-39910 and a Coldcard wallet flaw have been actively exploited, though no PoC, exploit code, or patch is provided.
Milk Sad (CVE-2023-39910) in 2023 was the same shape, Libbitcoin’s bx seed used a 32-bit Mersenne Twister seeded by system time. The playbook has been public for years.
Post summary
The post notes CVE‑2023‑39910 with a technical detail about Libbitcoin’s bx seed using a predictably seeded 32‑bit Mersenne Twister, but it offers no PoC, exploit, patch, or evidence of active exploitation.
@midmagic The same goes for this nonsense. You are embarrassing yourself. https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
Post summary
The post merely points to a GitHub page for CVE-2023-39910 without providing any substantive details, tools, or claims.
@pezcore23 Documentation explains what a function does. Otherwise you are just making up your own. The documentation was absolutely clear, and the WARNING (not disclaimer) was for emphasis. https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
Post summary
The post redirects to the CVE’s documentation, affirming that it clarifies a function definition, but it provides no technical details, exploit code, or patch information.
@satsfortheseoul @AutisticHODL CoinKite used proprietary secure element chips, look how that turned out for them. This is a known vulnerability that has been exploited before on a software utility tool. CVE-2023-39910 CoinKite's secure element chip was proprietary, bound by NDAs.
Post summary
The tweet references CVE-2023-39910, noting historical exploitation via a software utility, but offers no technical details or actionable information.
@SanctusGrail 鍵の脆弱性は無視されておらず、量子脅威（実用的リスク低、10,200 BTC影響）やメモリリーク（Bloodtrail Attack、CVE-2023-39910）で議論中。2025年ハックで鍵侵害が2.2億ドル損失の76%。対策: ハードウェアウォレット、ゼロ化、自己保管推奨。
Post summary
The post highlights CVE‑2023‑39910, noting it was actively exploited in a 2025 hack that caused significant financial loss, and recommends mitigation steps such as hardware wallets and zeroization.
@satoshihead @1440000bytes I’m sure you’ve read this previously, which makes it clear that you aren’t attempting to be honest above. https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
Post summary
The tweet merely references a CVE wiki page and accuses someone of dishonesty, providing no technical or exploit details.
@jamesob worth assuming the attacker mapped this curve before you did. milk sad (cve-2023-39910) was libbitcoin's bx seed on a 32-bit mersenne twister seeded by the clock, and the on-chain sweeping predated the 2023 advisory by years. tripwires measure their patience, not their reach.
Post summary
The tweet shares technical details about CVE‑2023‑39910, highlighting its seed mechanism and early on‑chain activity, but does not mention active exploitation, a PoC, patch, or debunking.
Yup, it was called CVE-2023-39910. There's rarely ever a first time for a vulnerability like this. https://milksad.info/
Post summary
The text briefly acknowledges the existence of CVE-2023-39910 but offers no additional details, exploit evidence, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | libbitcoin | libbitcoin_explorer | - | - | - |