United

Milk

Bitcoin

Security

Update (Feb. 15, 12:10 PM UTC): This article has been updated based on Binance's statement to reflect that&nbsp;Trust Wallet is a separate legal entity that is not part of the Binance group and operates independently from Binance.com.
Update (Feb. 15, 2:20 PM UTC): This article has been updated based on Binance's statement to reflect that Trust Wallet is a separat
An agency of the United States Department of Commerce is analyzing an older version of the “Binance Trust Wallet app” for a vulnerability that could allow an attacker to steal funds from crypto wallets.&nbsp;
<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-23660" target="_blank" rel="noopener nofollow">According</a> to the National Institute of Standards and Technology (NIST) — the agency tasked with promoting U.S. innovation and industrial competitiveness — a specific version of the Trust Wallet app “misuses the trezor-crypto library” to generate mnemonic words that can be verified only at the entropy source. 
An entropy source is a physical location from where data is generated. NIST noted that a similar vulnerability was exploited in July 2023, leading to economic losses. It explained:
<blockquote data-ct-non-breakable="true">
 “An attacker can systematically generate mnemonics for each timestamp within an applicable time frame, and link them to specific wallet addresses in order to steal funds from those wallets.”
</blockquote>
The information was made public on Feb. 8 and is currently awaiting analysis to determine the real-world scope of the vulnerability. Speaking to Cointelegraph, a Trust Wallet spokesperson highlighted that the use of the Trezor library was identified in 2018 and existed for iOS wallets created between March 2018 and fixed in July 2018. At the time, Trust Wallet was an open-source project and the issue impacted a finite number of 10,000 downloads. , so all the code commits and fixes are public and transparent at all times.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-02/75aab697-ece5-45c6-86dd-60286cf37ade.png" alt="" title="">
 <figcaption style="text-align: center;">
 Trust Wallet app for iOS under investigation for vulnerability. Source: NIST
 </figcaption>
</figure>
<a href="https://www.cve.org/CVERecord?id=CVE-2024-23660" target="_blank" rel="noopener nofollow">According</a> to CVE — a program sponsored by the U.S. Department of Homeland Security — Secbit Labs began <a href="https://secbit.io/blog/en/2024/01/19/trust-wallets-fomo3d-summer-vuln/" target="_blank" rel="noopener nofollow">investigating</a>&nbsp;the Trust Wallet app for iOS after numerous Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>) wallets were hacked. The researchers tracked down an older wallet generation weakness in the iOS platform version of Trust Wallet from 2018 and connected it to the large thefts on July 12, 2023.
Related: <a href="https://cointelegraph.com/news/bitcoin-inscriptions-national-vulnerability-database">Bitcoin inscriptions added to US National Vulnerability Database</a>
Speaking to Cointelegraph, a Binance spokesperson clarified that Trust Wallet is now a separate legal entity that is not part of the Binance group and operates independently from Binance.com.
An independent investigation by Milk Sad found at least 6,572 unique wallet mnemonics that risk loss of funds. It found the Trust Wallet app for iOS using an open-source code for generating new cryptocurrency wallets using unsafe functions in the “trezor-crypto library” that were not meant for production.&nbsp;After confirming that the weak wallets existed, it alleged that they were involved in the Milk Sad thefts. 
Upon completing the investigation, NIST will allot a base score to the app’s vulnerability ranging from 0-10, depending on its severity. It is also important to note that vulnerability on the Trezor crypto library is not a Trust Wallet specific problem, and could potentially impa
Magazine: <a href="https://cointelegraph.com/magazine/crypto-inevitable-all-in-meet-vance-spencer/">‘Crypto is inevitable’ so we went ‘all in’: Meet Vance Spencer, permabull</a>

US investigates Trust Wallet iOS app for vulnerability

Cointelegraph

2024년 2월 15일에 게재된 다른 기사

XRP Price Prediction: Will XRP Hit $1 In March?

Blockchain GameFi Developer Sky Mavis Reduces Liquidity Provider Rewards

Sillycat Price Prediction: SILLYCAT Surges 125%, Leaving Competitors Meow Meow Coin, Popcat, and ...

Bitcoin explosion: The secrets behind the spectacular jump to $50,000!

As Markets Go Green Across The Board, Solana (SOL) Profits Move Into DeeStream (DST) Presale Whil...

VeChain Launches Significant Upgrade, Catalyzing Price Surge in VET Cryptocurrency

무료 뉴스레터에 가입하여 매일 최신 암호화폐 소식을 받아보세요!