CVE-2024-23660: Trust Wallet Information Disclosure Flaw

CVE-2024-23660 Overview

CVE-2024-23660 affects the Binance Trust Wallet application for iOS at commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f (git tag 0.0.4). The application misuses the trezor-crypto library and generates wallet mnemonic seed phrases using only the device timestamp as the entropy source. This deterministic seed generation allows attackers to reconstruct mnemonics for any timestamp within a given window and link them to known wallet addresses. According to the description, the flaw was exploited in the wild in July 2023, resulting in theft of cryptocurrency funds. The weakness is classified under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator.

Critical Impact

Attackers can brute-force wallet mnemonics by iterating timestamps, derive private keys, and drain associated cryptocurrency wallets without any user interaction.

Affected Products

• Binance Trust Wallet for iOS, version 0.0.4
• Git commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f
• Wallets created with the vulnerable build on iPhone OS

Discovery Timeline

• July 2023 - Vulnerability exploited in the wild against affected wallets
• 2024-02-08 - CVE-2024-23660 published to NVD
• 2025-05-15 - Last updated in NVD database

Technical Details for CVE-2024-23660

Vulnerability Analysis

The vulnerability stems from improper use of the trezor-crypto library when generating BIP-39 mnemonic phrases. Mnemonic generation requires a cryptographically secure source of entropy, typically 128 or 256 bits drawn from a hardware RNG or operating system CSPRNG. The vulnerable Trust Wallet build instead seeded the mnemonic generator with the current device time. This collapses the effective entropy space from 2^128 to the number of seconds in the application's release window. An attacker who knows the approximate creation time of a wallet can enumerate all candidate mnemonics, derive deterministic key pairs through BIP-32 and BIP-44 hierarchies, and compute the resulting public addresses. Matching those addresses against on-chain balances yields private keys for any wallet still holding funds. The flaw enables full impersonation of the wallet owner across every blockchain derived from that seed.

Root Cause

The root cause is the substitution of a cryptographically secure random source with a low-entropy time value. The trezor-crypto library exposes mnemonic functions that expect caller-supplied entropy. The Trust Wallet iOS code at commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f supplied timestamp bytes instead of output from SecRandomCopyBytes or an equivalent CSPRNG. This pattern matches [CWE-338] and mirrors the earlier MilkSad class of vulnerabilities in other wallet implementations.

Attack Vector

Exploitation is performed off-device and requires no contact with the victim. An attacker enumerates timestamps across the period during which the vulnerable version was active. For each timestamp the attacker reproduces the mnemonic, derives the seed via PBKDF2-HMAC-SHA512, and walks the standard derivation paths to compute wallet addresses. Public blockchain explorers then reveal which derived addresses hold balances. The attacker signs transactions with the recovered private keys and transfers funds to wallets under their control. Refer to the MilkSad Research Update and SecBit Blog on Trust Wallet's Vulnerability for full technical reconstructions.

Detection Methods for CVE-2024-23660

Indicators of Compromise

• Unauthorized outbound transactions from wallets created in the vulnerable Trust Wallet iOS build between late 2018 and the patched release
• Wallet addresses derived from mnemonics that map to second-resolution timestamps within the vulnerable release window
• Funds consolidating into known MilkSad-cluster collector addresses documented in the external research references

Detection Strategies

• Identify wallets created with Trust Wallet iOS commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f or git tag 0.0.4 and treat their seeds as compromised
• Replay the vulnerable mnemonic generation routine across the release timeframe and check whether any internal or customer wallet address appears in the derived set
• Cross-reference wallet creation timestamps against on-chain transaction patterns matching the MilkSad attacker clusters

Monitoring Recommendations

• Continuously monitor at-risk wallet addresses for any signing activity and trigger alerts on outbound transfers
• Audit mobile device management (MDM) inventories for installations of legacy Trust Wallet iOS builds
• Track public threat intelligence feeds for new collector addresses associated with timestamp-seeded mnemonic theft

How to Mitigate CVE-2024-23660

Immediate Actions Required

• Generate a new wallet using a current, audited wallet application that draws entropy from the platform CSPRNG
• Transfer all assets out of any wallet created with Trust Wallet iOS 0.0.4 to the newly generated wallet immediately
• Revoke any token approvals and disconnect the compromised addresses from decentralized applications
• Treat the original mnemonic as permanently burned — never reuse it on any chain or derivation path

Patch Information

No vendor advisory URL is listed in the NVD record for this CVE. The vulnerable code path exists only in the historical commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f (tag 0.0.4). Subsequent Trust Wallet iOS releases replaced the time-based entropy with a cryptographically secure random source. Users must migrate funds rather than upgrade in place, because the seed itself is the compromised material.

Workarounds

• Do not import the affected mnemonic into any other wallet application — the seed remains brute-forceable regardless of the host app
• Use a hardware wallet for any high-value cryptocurrency holdings to ensure entropy is generated on a dedicated secure element
• Verify that wallet software in use sources mnemonic entropy from SecRandomCopyBytes on iOS or /dev/urandom on Linux/Android equivalents

# Verify that a mobile build links against the platform CSPRNG rather than time-based seeding
# Example: inspect an iOS binary for use of SecRandomCopyBytes
otool -L TrustWallet.app/TrustWallet | grep -i Security
nm TrustWallet.app/TrustWallet | grep -i SecRandomCopyBytes