CVE-2024-23660

The Binance Trust Wallet app for iOS (specifically git tag 0.0.4 , commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f ) contains a design flaw involving the misuse of the trezor-crypto library. This misuse results in the generation of mnemonic words where the device time is the sole source of entrop...

CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

CVE-2024-23660: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

VulnCheck KEV: CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

PT-2024-20010

Name of the Vulnerable Software and Affected Versions Binance Trust Wallet app for iOS version 0.0.4 Description The Binance Trust Wallet app for iOS misuses the trezor-crypto library, generating mnemonic words that use the device time as the only entropy source. This has led to economic losses, ...

Ripple Co-Founder’s Personal XRP Wallet Breached in $112 Million Hack

By Deeba Ahmed Ripple’s co-founder Chris Larsen has acknowledged that his personal XRP wallet was hacked. This is a post from HackRead.com Read the original post: Ripple Co-Founders Personal XRP Wallet Breached in $112 Million Hack...

Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines

Cybersecurity researchers have identified malicious packages on the open-source Python Package Index PyPI repository that deliver an information stealing malware called WhiteSnake Stealer on Windows systems. The malware-laced packages are named nigpal, figflix, telerer, seGMM, fbdebug, sGMM,...

Brave Android 1.62.152 Security Fixes

Updated Brave Wallet password policy. - Force the referrer to always be "no-referrer" while in Speedreader mode as reported on HackerOne by nishimunea. Upgraded Chromium to 121.0.6167.101 — refer to Google Chrome advisories for inherited CVEs...

Ethereum blockchain security breach

Ethereum Blockchain is a decentralized open source public blockchain platform with smart contract capabilities from the Ethereum Foundation. A security vulnerability exists in Ethereum blockchain that stems from the executeTransaction function in MultiSigWallet containing incorrect access control...

Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass

Description The plugin is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handleauthrequest' and 'hadleloginrequest'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an...

Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass

Description The plugin is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handleauthrequest' and 'hadleloginrequest'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an...

Here’s Some Bitcoin: Oh, and You’ve Been Served!

A California man who lost $100,000 in a 2021 SIM-swapping attack is suing the unknown holder of a cryptocurrency wallet that harbors his stolen funds. The case is thought to be the first in which a federal court has recognized the use of information included in a bitcoin transaction -- such as a...

When unpausing the GuardCM, not setting governorCheckProposalId to 0 puts the assets of the protocol at risk

Lines of code Vulnerability details Impact If the GuardCM was paused once, the community multisig CM can pause it again without checking for the governances activity. This moves the power within the system from the governance to the CM and can, in the worst case, result in the lose of all funds o...

StoreFront - Citrix Credential Wallet Service Error Event Id "9"

Multiple StoreFront servers are configured as a Server Group. The below Error Event ID 9 is logged in StoreFront servers. ----------------------- Source: Citrix Credential Wallet Service Event ID: 9 Description: An unexpected error occurred retrieving the credentials. -----------------------...

Crypto Hardware Wallet Ledger's Supply Chain Breach Results in $600,000 Theft

Crypto hardware wallet maker Ledger published a new version of its "@ledgerhq/connect-kit" npm module after unidentified threat actors pushed malicious code that led to the theft of more than $600,000 in virtual assets. The compromise was the result of a former employee falling victim to a phishi...

Malicious code in multiversx-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f98fdf8c728eafb929b2387abb537352eb1145b216abe16621bc44a851c23875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8674 Malicious code in multiversx-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f98fdf8c728eafb929b2387abb537352eb1145b216abe16621bc44a851c23875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in multiversx-wallet

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in cosmos-wallet-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6583493058b4f8536df13eb5c7c6418badcae8f4c6cb5122d75ad79db0f174fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8671 Malicious code in cosmos-wallet-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6583493058b4f8536df13eb5c7c6418badcae8f4c6cb5122d75ad79db0f174fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...