PT-2023-23277 · Unknown · Trust Wallet Browser Extension+1

Jean-Baptiste Bédrune · Published 2023-04-27 · Updated 2025-12-31 · CVE-2023-31290

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Trust Wallet Core versions prior to 3.1.1 Trust Wallet browser extension versions 0.0.172 through 0.0.182

Description The issue allows theft of funds due to insufficient entropy, which is 32 bits. This is because the mt19937 Mersenne Twister uses a single 32-bit value as an input seed, resulting in only four billion possible mnemonics. The issue has been exploited in the wild in December 2022 and March 2023. An attacker can efficiently steal funds by identifying Ethereum addresses created since the 0.0.172 release and checking if they could have been created by the affected extension.

Recommendations For Trust Wallet Core versions prior to 3.1.1, upgrade the product version and move funds to a new wallet address. For Trust Wallet browser extension versions 0.0.172 through 0.0.182, upgrade the product version and move funds to a new wallet address.

Exploit

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2023-31290

Affected Products

Trust Wallet Core

Trust Wallet Browser Extension

References · 10

• 🔥 https://blog.ledger.com/Funds-of-every-wallet-created-with-the-Trust-Wallet-browser-extension-could-have-been-stolen · Exploit
• https://github.com/trustwallet/wallet-core/compare/3.1.0...3.1.1 · Patch
• https://community.trustwallet.com/t/wasm-vulnerability-incident-update-and-recommended-actions/750786 · Vendor Advisory
• https://community.trustwallet.com/t/browser-extension-wasm-vulnerability-postmortem/750787 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31290 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31290 · Vendor Advisory
• https://twitter.com/DC3DCISE/status/2006375064435130479 · Twitter Post
• https://t.me/cvenotify/49167 · Telegram Post
• https://t.me/cvenotify/109305 · Telegram Post
• https://twitter.com/TrustWallet/status/1649699428733947906 · Note