CVE-2020-14199

BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures in certain cases, potentially leading to a huge transaction fee. NOTE: this affects all hardware wallets. It was fixed in 1.9.1 for the...

CVE-2020-18172

A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges...

CVE-2019-14353

On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might b...

New Phishing Kit Leverages SMS, Voice Calls to Target Cryptocurrency Users

A novel phishing kit has been observed impersonating the login pages of well-known cryptocurrency services as part of an attack cluster codenamed CryptoChameleon that's designed to primarily target mobile devices. "This kit enables attackers to build carbon copies of single sign-on SSO pages, the...

CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

Design/Logic Flaw

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

VulnCheck KEV: CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July...

PT-2024-20010

Name of the Vulnerable Software and Affected Versions Binance Trust Wallet app for iOS version 0.0.4 Description The Binance Trust Wallet app for iOS misuses the trezor-crypto library, generating mnemonic words that use the device time as the only entropy source. This has led to economic losses, ...

CVE-2024-23660

The CVE-2024-23660 entry concerns Binance Trust Wallet for iOS (version 0.0.4). The root cause is misuse of the trezor-crypto library, causing mnemonic words to be generated with device time as the sole entropy source. This leads to predictable mnemonics and potential theft of funds, with real-wo...

CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

Trezor Data Breach Exposes Email and Names of 66,000 Users

By Waqas The latest Trezor data breach places users at risk of phishing scams, potentially leading to the theft of additional login credentials. This is a post from HackRead.com Read the original post: Trezor Data Breach Exposes Email and Names of 66,000 Users...

Malicious Package

Overview trezor-translations-manager is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

Malicious code in trezor-translations-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d268d84dd223392a574ca54de1d0ddc5b49977e3ac246d2d4917ff9fc24aff3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in trezor-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6988db5be258f1aa0def05723411080dc261386d487115e474c4ba25b71d09e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6645 Malicious code in trezor-translations-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d268d84dd223392a574ca54de1d0ddc5b49977e3ac246d2d4917ff9fc24aff3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6647 Malicious code in trezor-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3e2071744b228e87630505134119577c682d77b075ccb6365d1b2f52dcfcc8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in trezor-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3e2071744b228e87630505134119577c682d77b075ccb6365d1b2f52dcfcc8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6646 Malicious code in trezor-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6988db5be258f1aa0def05723411080dc261386d487115e474c4ba25b71d09e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...