{"vulnerability": "CVE-2023-3991", "sightings": [{"uuid": "c585aa05-da98-4d2a-a6b9-4ee92e2c7bf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39910", "type": "seen", "source": "https://gist.github.com/soulcore-dev/21acc92c93041405608c9fcc8ffc8642", "content": "", "creation_timestamp": "2026-03-14T23:51:38.000000Z"}, {"uuid": "83ab81c9-ed2e-4ff5-bc51-4d58d2758937", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39910", "type": "seen", "source": "https://gist.github.com/drGrove/8ae4ef53d75b0033abf8f2438c72181a", "content": "", "creation_timestamp": "2026-01-22T23:06:00.000000Z"}, {"uuid": "6f4cfe21-f491-45b8-9ba7-8d95146859e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39910", "type": "published-proof-of-concept", "source": "Telegram/zaWOloGTmuxgYwScvhSZBdX4Ig42r1BJF11flVCmJ6M5QnQ", "content": "", "creation_timestamp": "2026-01-07T21:00:04.000000Z"}, {"uuid": "8a09cc25-4c75-435d-b5e2-c8b189725bf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39910", "type": "exploited", "source": "https://t.me/arpsyndicate/2679", "content": "#ExploitObserverAlert\n\nCVE-2023-39910\n\nDESCRIPTION: Exploit Observer has 9 entries related to CVE-2023-39910. The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from \"bx seed\" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against \"bx seed\" but others disagree. NOTE: this was exploited in the wild in June and July 2023.\n\nFIRST-EPSS: 0.001160000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2024-01-08T20:34:20.000000Z"}, {"uuid": "fbb3fc6d-cbb5-4ee6-b538-20de418abf49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39914", "type": "seen", "source": "https://t.me/cibsecurity/70395", "content": "\u203c CVE-2023-39914 \u203c\n\nNLnet Labs\u00e2\u20ac\u2122 bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-13T18:23:51.000000Z"}, {"uuid": "3fd2fe8e-341c-486e-b186-a7a8c208c79b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39916", "type": "seen", "source": "https://t.me/cibsecurity/70393", "content": "\u203c CVE-2023-39916 \u203c\n\nNLnet Labs\u00e2\u20ac\u2122 Routinator 0.9.0 up to and including 0.12.1 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for an attacker to craft a URL that results in the response being stored outside of the directory specified for it.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-13T18:23:46.000000Z"}, {"uuid": "30113474-2d22-4169-8128-b3b01d62c212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39914", "type": "seen", "source": "https://t.me/cibsecurity/70392", "content": "\u203c CVE-2023-39915 \u203c\n\nNLnet Labs\u00e2\u20ac\u2122 Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-13T18:23:45.000000Z"}, {"uuid": "2b99bf4f-54d1-4279-a595-1825ef025c16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39915", "type": "seen", "source": "https://t.me/cibsecurity/70392", "content": "\u203c CVE-2023-39915 \u203c\n\nNLnet Labs\u00e2\u20ac\u2122 Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-13T18:23:45.000000Z"}, {"uuid": "815c845d-8455-4fbb-9a2c-adb38b5f879b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39919", "type": "seen", "source": "https://t.me/cibsecurity/69768", "content": "\u203c CVE-2023-39919 \u203c\n\nAuth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in maennchen1.De wpShopGermany \u00e2\u20ac\u201c Protected Shops plugin <=\u00c2\u00a02.0 versions.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-04T14:16:26.000000Z"}, {"uuid": "adaecd71-1dac-4c6f-b295-5cb550a71756", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39918", "type": "seen", "source": "https://t.me/cibsecurity/69762", "content": "\u203c CVE-2023-39918 \u203c\n\nUnauth. Reflected Cross-Site Scripting (XSS) vulnerability in SAASPROJECT Booking Package Booking Package plugin <=\u00c2\u00a01.6.01 versions.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-04T14:16:18.000000Z"}, {"uuid": "b48a9f25-e32b-4f9a-8b4c-b5657c70db45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39912", "type": "seen", "source": "https://t.me/cibsecurity/69616", "content": "\u203c CVE-2023-39912 \u203c\n\nZoho ManageEngine ADManager Plus through 7202 allows admin users to download any file from the server machine via directory traversal.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-01T02:18:26.000000Z"}, {"uuid": "0ba9fd08-1662-41ad-b9c5-71738e0e755f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39910", "type": "seen", "source": "https://gist.github.com/iintothewind/f8e3f3cb470d7cd02b1f2e4755d85419", "content": "# \u6570\u5b57\u94b1\u5305\u5b89\u5168\u5206\u6790\uff1a\u5f31\u71b5\u653b\u51fb\u7684\u56db\u4e2a\u6837\u672c\uff082023\u20132026\uff09\n\n> \u5206\u6790\u57fa\u4e8e\u516c\u5f00\u7814\u7a76\u8d44\u6599\uff0c\u8986\u76d6 2023 \u81f3 2026 \u5e74\u56db\u8d77\u7531\u300c\u5f31\u968f\u673a\u6570\u300d\u5f15\u53d1\u7684\u6570\u5b57\u94b1\u5305\u8d44\u91d1\u5931\u7a83\u4e8b\u4ef6\u3002\u6838\u5fc3\u8bba\u70b9\uff1a**\u968f\u673a\u6027\u662f\u5bc6\u7801\u5b89\u5168\u7684\u5730\u57fa\uff0c\u71b5\u584c\u7f29\u662f\u94b1\u5305\u7c7b\u4ea7\u54c1\u6700\u9690\u853d\u3001\u6700\u81f4\u547d\u7684\u6f0f\u6d1e\u7c7b\u578b\u2014\u2014\u5b83\u4e0d\u53ef\u81ea\u67e5\u3001\u4e0d\u53ef\u4fee\u590d\u3001\u4e14\u653b\u51fb\u8005\u603b\u662f\u5148\u4e8e\u5b89\u5168\u793e\u533a\u53d1\u73b0\u3002**\n\n---\n\n## \u6458\u8981\n\n| \u4e8b\u4ef6 | \u65f6\u95f4 | \u94b1\u5305\u5f62\u6001 | \u71b5\u584c\u7f29 | \u635f\u5931\u89c4\u6a21 |\n|---|---|---|---|---|\n| Trust Wallet \u6d4f\u89c8\u5668\u6269\u5c55 | 2022\u20132023 | \u8f6f\u4ef6\u94b1\u5305\uff08\u6d4f\u89c8\u5668\u6269\u5c55\uff09 | \u5f31\u968f\u673a\u6570 | ~$170M\uff08\u5386\u53f2\u6700\u5927\u5f31\u71b5\u6848\u4e4b\u4e00\uff09 |\n| Milk Sad (CVE-2023-39910) | 2023-05 \u8d77\u5229\u7528 | CLI \u5de5\u5177\uff08Libbitcoin Explorer `bx`\uff09 | 128\u2192**32 \u4f4d** | \u6570\u767e\u4e07\u7f8e\u5143 |\n| Ill Bloom | 2026-05-27 \u8d77\u5229\u7528 | \u5c0f\u4f17\u79fb\u52a8\u8f6f\u4ef6\u94b1\u5305 | \u672a\u91cf\u5316 | $5.69M+\uff08\u6301\u7eed\u4e2d\uff09 |\n| Coldcard \u56fa\u4ef6\u6f0f\u6d1e | 2026-07-30 \u8d77\u5229\u7528 | \u786c\u4ef6\u94b1\u5305\uff08Coldcard Mk2\u2013Q\uff09 | 128\u2192**40/72 \u4f4d** | ~$89M\uff081,367 BTC\uff09 |\n\n\u56db\u4e2a\u4e8b\u4ef6\u6a2a\u8de8**\u6240\u6709\u94b1\u5305\u5f62\u6001**\uff1aCLI\u3001\u6d4f\u89c8\u5668\u6269\u5c55\u3001\u79fb\u52a8\u5e94\u7528\u3001\u786c\u4ef6\u8bbe\u5907\u3002\u65e0\u4e00\u5e78\u514d\u3002\n\n---\n\n## \u4e00\u3001\u4ec0\u4e48\u662f\u300c\u71b5\u584c\u7f29\u300d\uff1a\u4e3a\u4ec0\u4e48 40 \u4f4d\u548c 128 \u4f4d\u7684\u5dee\u8ddd\u662f\u300c\u9501 vs \u6ca1\u9501\u300d\n\n\u52a0\u5bc6\u94b1\u5305\u7684\u5b89\u5168\u6027\u5efa\u7acb\u5728**\u5bc6\u94a5\u7a7a\u95f4\u8db3\u591f\u5927**\u4e4b\u4e0a\uff1a\n\n- 128 \u4f4d\u71b5\uff08\u6807\u51c6 12 \u8bcd BIP-39 \u52a9\u8bb0\u8bcd\uff09\uff1a2^128 \u2248 3.4\u00d710^38 \u79cd\u7ec4\u5408\u3002\u7269\u7406\u4e0a\u4e0d\u53ef\u66b4\u529b\u7834\u89e3\u2014\u2014\u5b87\u5b99\u70ed\u5bc2\u90fd\u7b97\u4e0d\u5b8c\u3002\n- 40 \u4f4d\u71b5\uff08Coldcard Mk3 \u53d7\u5f71\u54cd\u8bbe\u5907\uff09\uff1a2^40 \u2248 1.1 \u4e07\u4ebf\u79cd\u7ec4\u5408\u3002**\u79df\u7528\u4e91\u670d\u52a1\u5668\u51e0\u5929\u5185\u53ef\u904d\u5386\u3002**\n- 32 \u4f4d\u71b5\uff08Milk Sad \u53d7\u5f71\u54cd\u8bbe\u5907\uff09\uff1a2^32 \u2248 42.9 \u4ebf\u79cd\u7ec4\u5408\u3002**\u4e00\u53f0\u6e38\u620f PC \u4e00\u5929\u5185\u53ef\u904d\u5386\u3002**\n\n\u300c128 \u4f4d\u548c 40 \u4f4d\u4e4b\u95f4\u7684\u5dee\u5f02\uff0c\u662f\u65e0\u6cd5\u88ab\u6253\u5f00\u7684\u9501\u548c\u53ef\u4ee5\u88ab\u6253\u5f00\u7684\u9501\u4e4b\u95f4\u7684\u533a\u522b\u300d\u2014\u2014\u8fd9\u662f Coldcard \u4e8b\u4ef6\u62a5\u9053\u4e2d\u6700\u51c6\u786e\u7684\u4e00\u53e5\u8bdd\u3002\n\n**\u5173\u952e\u8ba4\u77e5\uff1a\u71b5\u584c\u7f29\u4e0d\u6539\u53d8\u94b1\u5305\u7684\u5916\u5728\u8868\u73b0\u3002** \u754c\u9762\u7167\u5e38\u663e\u793a 12 \u4e2a\u52a9\u8bb0\u8bcd\uff0c\u4e00\u5207\u6b63\u5e38\uff1b\u4f46\u653b\u51fb\u8005\u4e0d\u9700\u8981\u63a5\u89e6\u4f60\u7684\u8bbe\u5907\u2014\u2014\u53ea\u9700\u590d\u73b0\u968f\u673a\u6570\u751f\u6210\u8fc7\u7a0b\u3001\u6d3e\u751f\u5730\u5740\u3001\u4e0e\u516c\u5f00\u94fe\u4e0a\u6570\u636e\u6bd4\u5bf9\u4f59\u989d\uff0c\u5c31\u80fd\u9694\u7a7a\u53d6\u5f97\u5bc6\u94a5\u3002\n\n---\n\n## \u4e8c\u3001\u56db\u4e2a\u6848\u4f8b\u7684\u6839\u56e0\u89e3\u5256\n\n### \u6848\u4f8b 1\uff1aMilk Sad\uff08CVE-2023-39910\uff09\u2014\u2014\u300c\u62ab\u7740\u5927\u8863\u7684 32 \u4f4d\u6570\u300d\n\n- **\u8f6f\u4ef6**\uff1aLibbitcoin Explorer\uff08`bx`\uff09\uff0c\u547d\u4ee4\u884c\u94b1\u5305\u5de5\u5177\uff0c\u88ab\u300aMastering Bitcoin\u300b\u7b49\u6743\u5a01\u6559\u6750\u63a8\u8350\u7528\u4e8e\u751f\u6210\u94b1\u5305\u3002\n- **\u6839\u56e0**\uff1a`bx seed` \u4f7f\u7528 **Mersenne Twister\uff08\u6885\u68ee\u65cb\u8f6c\uff09** \u751f\u6210\u5bc6\u94a5\u71b5\u3002MT \u662f**\u975e\u5bc6\u7801\u5b66 PRNG**\u2014\u2014\u8bbe\u8ba1\u76ee\u7684\u662f\u79d1\u5b66\u8ba1\u7b97\u6a21\u62df\uff0c\u4e0d\u662f\u5bc6\u94a5\u751f\u6210\u3002\u66f4\u81f4\u547d\u7684\u662f\uff0c\u5b83\u4ee5**\u7cfb\u7edf\u65f6\u95f4\u7684 32 \u4f4d**\u4f5c\u4e3a\u79cd\u5b50\u3002\n- **\u7ed3\u679c**\uff1a\u540d\u4e49 128/192/256 \u4f4d\u5bc6\u94a5\uff0c\u5b9e\u9645\u6709\u6548\u672a\u77e5\u4fe1\u606f\u4ec5 **32 \u4f4d**\u3002\u7814\u7a76\u56e2\u961f\u79f0\u5176\u4e3a \"a 32 bit number in a trench coat\"\uff08\u62ab\u7740\u5927\u8863\u7684 32 \u4f4d\u6570\uff09\u3002\n- **\u4ee3\u53f7\u7531\u6765**\uff1a\u5728\u7cfb\u7edf\u65f6\u95f4 = 0.0 \u65f6\u8fd0\u884c `bx seed`\uff0c\u6c38\u8fdc\u751f\u6210\u540c\u4e00\u52a9\u8bb0\u8bcd\uff0c\u5f00\u5934\u4e3a **\"milk sad wage cup \u2026\"**\u2014\u2014\u7b2c\u4e00\u4e2a\u5f31\u77ed\u8bed\u7684\u524d\u4e24\u4e2a\u8bcd\u6210\u4e86\u6f0f\u6d1e\u4ee3\u53f7\u3002\u4e00\u4e2a\u300c\u968f\u673a\u300d\u7cfb\u7edf\u6700\u786e\u5b9a\u6027\u7684\u8f93\u51fa\uff0c\u547d\u540d\u4e86\u6574\u573a\u707e\u96be\u3002\n- **\u65f6\u95f4\u7ebf**\uff1a2022-11 \u524d\u4f20\u6f0f\u6d1e\uff08\u53e6\u4e00\u94b1\u5305\u8f6f\u4ef6\uff09\u2192 2023-05 \u521d\u59cb\u5229\u7528 \u2192 **2023-07-12 \u4e3b\u653b\u65e5**\uff08\u8de8\u94fe\u534f\u8c03\u6e05\u626b\uff0c\u6570\u767e\u4e07\u7f8e\u5143\u3001\u6570\u767e\u53d7\u5bb3\u8005\uff09\u2192 2023-07 \u672b\u56e2\u961f\u7ec4\u5efa\u30012.5 \u5468\u51b2\u523a\u7814\u7a76\u3001\u62ab\u9732\u3002\n- **\u300c\u7eb8\u94b1\u5305\u9501\u91d1\u5e93\u4e5f\u6551\u4e0d\u4e86\u4f60\u300d**\uff1a\u653b\u51fb\u4e0d\u4f9d\u8d56\u53d7\u5bb3\u8005\u8bbe\u5907\u4e0a\u7684\u4efb\u4f55\u4fe1\u606f\u3002\u7269\u7406\u9694\u79bb\u5bf9\u71b5\u7f3a\u9677\u65e0\u6548\u2014\u2014\u8106\u5f31\u70b9\u5728**\u751f\u6210\u8fc7\u7a0b**\u800c\u975e\u5b58\u50a8\u8fc7\u7a0b\u3002\n\n### \u6848\u4f8b 2\uff1aTrust Wallet \u6d4f\u89c8\u5668\u6269\u5c55\u2014\u2014\u524d\u4f20\n\n- Milk Sad \u56e2\u961f\u660e\u786e\u6307\u51fa Trust Wallet \u4e8b\u4ef6\u662f\u300c\u6700\u63a5\u8fd1\u7684\u65e9\u671f\u6f0f\u6d1e\u300d\uff08closest earlier vulnerability\uff09\uff0c2022-11 \u88ab\u53d1\u73b0\u3001\u968f\u5373\u88ab\u5229\u7528\u3002\n- \u635f\u5931\u89c4\u6a21\u8fdc\u8d85 Milk Sad\uff08\u6570\u4ebf\u7f8e\u5143\u7ea7\uff09\uff0c\u662f\u5f31\u71b5\u653b\u51fb\u53f2\u4e0a\u91d1\u989d\u6700\u5927\u7684\u4e00\u73af\u3002\n- \u4e0e Milk Sad \u540c\u6784\uff1a\u6d4f\u89c8\u5668\u6269\u5c55\u73af\u5883\u4e2d\u968f\u673a\u6570\u751f\u6210\u7f3a\u9677\uff0c\u5bfc\u81f4\u5bc6\u94a5\u53ef\u9884\u6d4b\u3002\n\n### \u6848\u4f8b 3\uff1aIll Bloom\uff08Coinspect \u7814\u7a76\uff0c2026\uff09\u2014\u2014\u4ecd\u5728\u8fdb\u884c\u7684\u6e05\u626b\n\n- **\u6839\u56e0**\uff1a\u5c0f\u4f17\u79fb\u52a8\u8f6f\u4ef6\u94b1\u5305\u5728\u751f\u6210 12 \u8bcd BIP-39 \u6062\u590d\u77ed\u8bed\u65f6\u4f7f\u7528**\u5f31 PRNG**\uff0c\u77ed\u8bed\u5f3a\u5ea6\u8fdc\u4f4e\u4e8e 128 \u4f4d\u9884\u671f\u3002\n- **\u62ab\u9732\u7b56\u7565**\uff1aCoinspect \u91c7\u7528**\u5206\u9636\u6bb5\u62ab\u9732**\u2014\u2014\"We are sharing information with teams that can use it to protect users, **while avoiding details that could make exploitation easier**\"\uff08\u4e0e\u5382\u5546\u534f\u4f5c\u4fdd\u62a4\u7528\u6237\uff0c\u4f46\u4e0d\u516c\u5e03\u53ef\u80fd\u964d\u4f4e\u5229\u7528\u95e8\u69db\u7684\u7ec6\u8282\uff09\u3002\u539f\u56e0\uff1a**\u653b\u51fb\u4ecd\u5728\u8fdb\u884c**\uff0c\u5386\u53f2\u66b4\u9732\u5cf0\u503c\u8fbe $12.56M\uff082022-04\uff09\uff0c\u7a7a\u95f4\u53ef\u80fd\u5c1a\u672a\u626b\u5b8c\u3002\n- **\u65b9\u6cd5\u8bba**\uff08\u5df2\u516c\u5f00\u90e8\u5206\uff0c\u6280\u672f\u542b\u91cf\u9ad8\uff09\uff1a\n  - **Stage 1 \u79cd\u5b50\u53d1\u73b0**\uff1a\u4ece\u5f31 PRNG \u91cd\u5efa\u5019\u9009\u77ed\u8bed \u2192 \u6d3e\u751f\u5404\u94fe\u9996\u5730\u5740 \u2192 \u4e0e Google BigQuery \u516c\u5f00\u94fe\u4e0a\u6570\u636e\u96c6\u6bd4\u5bf9\uff08BTC 15 \u4ebf\u5730\u5740 / ETH 3.41 \u4ebf / EVM 1.9 \u4ebf / Tron 2.54 \u4ebf\uff09\u2192 \u547d\u4e2d\u5373\u786e\u8ba4\u79cd\u5b50\u3002\n  - **Stage 2 \u5730\u5740\u6269\u5c55**\uff1a\u5bf9\u547d\u4e2d\u79cd\u5b50\u786e\u5b9a\u6027\u6d3e\u751f\u5168\u90e8\u8def\u5f84\uff08BIP44/49/84\u3001Ledger \u98ce\u683c\u3001Solana Phantom/Solflare\u3001Cosmos\u3001Nano\u3001Rootstock \u7b49\uff09\uff0c\u6784\u6210\u7ea6 2,805 \u4e2a\u77ed\u8bed\u7684\u66b4\u9732\u5730\u5740\u96c6\u3002\n  - **\u94fe\u4e0a\u53d6\u8bc1**\uff1a\u4e24\u6ce2\u6e05\u626b\u3002\u7b2c\u4e00\u6ce2\uff082026-05-27\uff09\u6bcf\u53d7\u5bb3\u8005\u72ec\u7acb\u76ee\u6807\u5730\u5740\uff1b\u7b2c\u4e8c\u6ce2\uff082026-05-30~07-13\uff09\u591a\u6570\u53d7\u5bb3\u8005\u5f52\u96c6\u5230\u5c11\u91cf\u590d\u7528\u6536\u96c6\u5730\u5740\uff08BTC 4 \u4e2a\u3001EVM 5 \u4e2a\uff09\u2014\u2014\u9ad8 fan-in \u5c18\u5f52\u96c6\u6a21\u5f0f\u6210\u4e3a\u8bc6\u522b\u6e05\u626b\u7684\u9c9c\u660e\u7279\u5f81\u3002\n  - \u4e24\u6ce2\u5408\u8ba1 $5.69M\uff1b\u8c03\u67e5\u6301\u7eed\u4e2d\u3002\n- **\u786c\u6027\u7ed3\u8bba**\uff1a\u66f4\u65b0 App \u6216\u628a\u65e7\u52a9\u8bb0\u8bcd\u5bfc\u5165\u5176\u4ed6\u94b1\u5305**\u4e0d\u4f1a\u8ba9\u8d44\u91d1\u5b89\u5168**\u2014\u2014\u5fc5\u987b\u751f\u6210\u5168\u65b0\u52a9\u8bb0\u8bcd\u3002\n\n### \u6848\u4f8b 4\uff1aColdcard \u56fa\u4ef6\u6f0f\u6d1e\uff082026-07-30 \u8d77\uff09\u2014\u2014\u786c\u4ef6\u94b1\u5305\u4e5f\u4e0d\u5b89\u5168\n\n- **\u4ea7\u54c1**\uff1aCoinkite \u7684 Coldcard\uff0c\u6bd4\u7279\u5e01\u786c\u4ef6\u94b1\u5305\uff0c\u4e3b\u6253\u5356\u70b9\u300c\u51b7\u300d\u2014\u2014\u4e0d\u8054\u7f51\u3001\u5bc6\u94a5\u4e0d\u79bb\u8bbe\u5907\u3001\u653b\u51fb\u8005\u9700\u7269\u7406\u63a5\u89e6\u624d\u80fd\u76d7\u53d6\u3002\n- **\u6839\u56e0\u94fe**\uff08Block \u516c\u53f8\u9006\u5411\uff0c\u6700\u5b8c\u6574\u7684\u6280\u672f\u62ab\u9732\uff09\uff1a\n  1. Coinkite \u6709\u81ea\u5df1\u7684\u786c\u4ef6 RNG \u5305\u88c5\u5668\uff0c\u751f\u4ea7\u914d\u7f6e\u5c06 MicroPython \u5b8f\u8bbe\u4e3a `MICROPY_HW_ENABLE_RNG = 0`\uff1b\n  2. libngu \u52a0\u5bc6\u5e93\u68c0\u67e5\u8be5\u5b8f\u65f6\u7528\u7684\u662f**\u300c\u5b8f\u662f\u5426\u88ab\u5b9a\u4e49\u300d**\u800c\u975e**\u300c\u5b8f\u662f\u5426\u4e3a\u771f\u300d**\uff1b\n  3. \u5b8f\u5b58\u5728\uff08\u503c 0\uff09\u2192 libngu \u8bef\u4ee5\u4e3a\u786c\u4ef6 RNG \u53ef\u7528 \u2192 \u5b9e\u9645\u7ed1\u5b9a MicroPython \u7684\u515c\u5e95 PRNG **Yasmarang**\uff08\u73a9\u5177\u7ea7\u975e\u5bc6\u7801\u5b66 PRNG\uff09\uff1b\n  4. Yasmarang \u4ee5**\u82af\u7247\u552f\u4e00 ID + \u5b9a\u65f6\u5668\u5bc4\u5b58\u5668**\u4e3a\u79cd\u5b50\uff0c**\u521d\u59cb\u5316\u540e\u4e0d\u518d\u6536\u96c6\u65b0\u71b5**\uff1b\n  5. \u79cd\u5b50\u7a7a\u95f4\u4ece 128 \u4f4d\u574d\u7f29\u5230 **Mk3 \u7ea6 40 \u4f4d / Mk4/Mk5/Q \u7ea6 72 \u4f4d**\u3002\n- **\u5229\u7528\u65b9\u5f0f**\uff1a\u653b\u51fb\u8005\u4e0d\u9700\u63a5\u89e6\u786c\u4ef6\u2014\u2014\u590d\u73b0\u5019\u9009\u8f93\u51fa\u6d41 \u2192 \u6d3e\u751f\u5730\u5740 \u2192 \u6bd4\u5bf9\u94fe\u4e0a\u4f59\u989d \u2192 \u76f4\u63a5\u82b1\u3002\u53d7\u5bb3\u8303\u56f4\u53d6\u51b3\u4e8e**\u751f\u6210\u79cd\u5b50\u65f6\u8fd0\u884c\u7684\u56fa\u4ef6\u7248\u672c**\uff0c\u800c\u975e\u5f53\u524d\u7248\u672c\uff1a\n  - Mk2/Mk3\uff1a4.0.0\u20134.1.9\uff082021-03 \u5f15\u5165\uff0c\u6f5c\u4f0f\u7ea6 5 \u5e74\uff09\n  - Mk4/Mk5\uff1a5.6.0 \u4e4b\u524d\uff1bQ\uff1a1.5.0Q \u4e4b\u524d\n- **\u4e09\u6ce2\u6e05\u626b**\uff08Galaxy Research \u94fe\u4e0a\u8ffd\u8e2a\uff09\uff1a\n\n| \u6ce2\u6b21 | \u65f6\u95f4 | \u5730\u5740\u6570 | BTC | \u624b\u6cd5\u7279\u5f81 |\n|---|---|---|---|---|\n| \u7b2c\u4e00\u6ce2 | 2026-07-30 | 1,196 | 1,083 | 41 \u5206\u949f\u6e05\u5b8c\uff1b\u5148\u5403\u6700\u5927\u4f59\u989d\uff08\u5f00\u62a2 10 \u5206\u949f\u5377\u8d70 ~$30M\uff09\uff1b\u5355\u4e2a\u5730\u5740\u9010\u4e2a\u626b\uff1b\u5171\u4eab\u5f52\u96c6\u5730\u5740\uff1b\u53ea\u626b\u9ed8\u8ba4\u6d3e\u751f\u8def\u5f84 |\n| \u7b2c\u4e8c\u6ce2 | 2026-08-01 \u524d\u540e | \u7ea6 1,400 | \u7ea6 75 | \u624b\u6cd5\u8fc7\u6e21 |\n| \u7b2c\u4e09\u6ce2 | 2026-08-02 | 1,912 | 208 | \u4eba\u5747\u4ec5 ~0.1 BTC\uff08\u80a5\u8089\u5df2\u626b\u5b8c\uff09\uff1b\u6bcf\u53d7\u5bb3\u8005\u72ec\u7acb\u76ee\u6807\u5730\u5740\uff1b\u6539\u7528 P2WSH \u8f93\u51fa\uff08\u53ef\u85cf multisig/timelock\uff09\uff1b\u6bcf\u6279\u6253\u5305 6 \u4eba |\n\n- Galaxy \u5224\u65ad\u6bcf\u6ce2\u5185\u90e8\u662f\u5355\u4e00\u64cd\u4f5c\u8005\uff0c\u4f46\u4e09\u6ce2\u662f\u5426\u540c\u4e00\u4eba**\u65e0\u6cd5\u4ece\u94fe\u4e0a\u786e\u8ba4**\u3002\n- **\u8865\u6551**\uff1aCoinkite 2026-07-31 \u53d1\u5e03\u7d27\u6025\u56fa\u4ef6\uff0c\u4f46**\u66f4\u65b0\u4e0d\u4fee\u590d\u5df2\u6709\u79cd\u5b50**\u2014\u2014\u5f31\u71b5\u79cd\u5b50\u6c38\u8fdc\u5f31\uff0c\u552f\u4e00\u89e3\u6cd5\u662f\u5728\u66f4\u65b0\u540e\u7684\u786c\u4ef6\u4e0a\u751f\u6210\u5168\u65b0\u94b1\u5305\u5e76\u8fc1\u79fb\u3002\u628a\u65e7\u79cd\u5b50\u6062\u590d\u5230\u65b0\u56fa\u4ef6 = \u628a\u5f31\u70b9\u5e26\u8fc7\u53bb\u3002\n- **\u514d\u75ab\u4eba\u7fa4**\uff1a\u7528\u81f3\u5c11 50 \u6b21\u516c\u5e73\u72ec\u7acb\u79c1\u5bc6\u9ab0\u5b50\u751f\u6210\u79cd\u5b50\u7684\u7528\u6237\u4e0d\u53d7\u5f71\u54cd\uff08\u71b5\u6765\u81ea\u4eba\u5de5\u8f93\u5165\u800c\u975e PRNG\uff09\u3002\n\n---\n\n## \u4e09\u3001\u8de8\u6848\u4f8b\u89c4\u5f8b\uff1a\u4e3a\u4ec0\u4e48\u8fd9\u662f\u6700\u300c\u9634\u300d\u7684\u6f0f\u6d1e\u7c7b\u578b\n\n**\u2460 \u751f\u6210\u65f6\u96f6\u5f02\u5e38\uff0c\u7528\u6237\u96f6\u611f\u77e5\u3002**\n\u56db\u4e2a\u6848\u4f8b\u65e0\u4e00\u4f8b\u5916\uff1a\u94b1\u5305\u754c\u9762\u6b63\u5e38\u3001\u52a9\u8bb0\u8bcd\u683c\u5f0f\u6b63\u786e\u3001\u4e00\u5207\u770b\u8d77\u6765\u5b8c\u7f8e\u3002\u6f0f\u6d1e\u85cf\u5728\u968f\u673a\u6570\u751f\u6210\u7684\u6700\u5e95\u5c42\uff0c\u975e\u9006\u5411\u65e0\u6cd5\u5bdf\u89c9\u3002\n\n**\u2461 \u4fee\u590d\u6c38\u8fdc\u53ea\u6cbb\u65b0\u5bc6\u94a5\uff0c\u65e7\u5bc6\u94a5\u6c38\u4e45\u8106\u5f31\u3002**\n\u56db\u6848\u4e00\u81f4\u94c1\u5f8b\uff1a\u8865\u4e01\u53ea\u4fdd\u62a4\u65b0\u751f\u6210\u7684\u94b1\u5305\u3002Milk Sad FAQ \u539f\u8bdd\uff1a\"All funds stored using previously generated wallets will remain vulnerable, and need to be migrated to a new secure wallet.\" \u8fd9\u4e5f\u662f\u6240\u6709\u7814\u7a76\u56e2\u961f\u90fd\u8981\u505a\u300c\u53d7\u5bb3\u8005\u81ea\u67e5\u5de5\u5177\u300d\u7684\u539f\u56e0\u2014\u2014\u80fd\u505a\u7684\u53ea\u6709**\u5728\u672a\u88ab\u6e05\u626b\u524d\u8ba9\u53d7\u5bb3\u8005\u8fc1\u79fb**\u3002\n\n**\u2462 \u653b\u51fb\u8005\u6c38\u8fdc\u9886\u5148\u3002**\nMilk Sad 2023-05 \u5f00\u59cb\u5229\u7528\u30017 \u6708\u624d\u88ab\u8ffd\u8ba4\uff1bIll Bloom 2026-05-27 \u7b2c\u4e00\u8bc1\u636e\u30017 \u6708\u624d\u62ab\u9732\uff1bColdcard \u6f0f\u6d1e 2021-03 \u5f15\u5165\u30012026-07 \u624d\u88ab\u5229\u7528\u5e76\u53d1\u73b0\u3002**\u5b89\u5168\u793e\u533a\u603b\u662f\u5728\u8ffd\u8ba4**\u2014\u2014\u56e0\u4e3a\u6ca1\u4eba\u5ba1\u8ba1\u8fd9\u4e9b\u751f\u6210\u8def\u5f84\u3002\n\n**\u2463 \u6839\u56e0\u5f62\u6001\u5343\u53d8\u4e07\u5316\uff0c\u6b8a\u9014\u540c\u5f52\u3002**\n- Milk Sad\uff1a\u9009\u9519\u7b97\u6cd5\uff08MT + \u65f6\u95f4\u79cd\u5b50\uff09\n- Trust Wallet\uff1a\u6d4f\u89c8\u5668\u6269\u5c55\u968f\u673a\u6570\u7f3a\u9677\n- Ill Bloom\uff1a\u8f6f\u4ef6\u5f31 PRNG\n- Coldcard\uff1a**\u5b8f\u5b58\u5728\u6027\u68c0\u67e5 bug**\uff08`#ifdef` vs `#if`\uff09\n\n\u56db\u79cd\u5b8c\u5168\u4e0d\u540c\u7684\u7ffb\u8f66\u65b9\u5f0f\uff0c\u5171\u540c\u7ed3\u679c\u90fd\u662f\u300c\u5bc6\u94a5\u7a7a\u95f4\u574d\u7f29\u300d\u3002\n\n**\u2464 \u653b\u51fb\u624b\u6cd5\u4f1a\u8fdb\u5316\u3002**\nColdcard \u4e09\u6ce2\u6e05\u626b\u7684\u6f14\u8fdb\uff08\u5355\u5730\u5740\u2192\u6279\u91cf\u3001\u5171\u4eab\u5f52\u96c6\u2192\u72ec\u7acb\u76ee\u6807\u3001P2PKH\u2192P2WSH\uff09\u8bf4\u660e\uff1a\u653b\u51fb\u8005\u5728**\u88ab\u516c\u5f00\u8bc6\u522b\u540e**\u4f1a\u4e3b\u52a8\u6539\u53d8\u94fe\u4e0a\u6307\u7eb9\uff0c\u89c4\u907f\u8ffd\u8e2a\u3002\u5b89\u5168\u7814\u7a76\u662f\u732b\u9f20\u6e38\u620f\u3002\n\n---\n\n## \u56db\u3001\u62ab\u9732\u4f26\u7406\uff1a\u516c\u5f00 vs \u5206\u9636\u6bb5\n\n| | Milk Sad / Coldcard | Ill Bloom |\n|---|---|---|\n| \u7ec6\u8282\u62ab\u9732 | \u5168\u516c\u5f00 | \u5206\u9636\u6bb5\uff0c\u4fdd\u7559\u53ef\u5229\u7528\u7ec6\u8282 |\n| \u7406\u7531 | \u53d7\u5bb3\u8005\u9700\u81ea\u67e5\u8fc1\u79fb\uff1b\u653b\u51fb\u5df2\u8fd1\u5c3e\u58f0\uff08Coldcard \u80a5\u8089\u626b\u5b8c\uff09 | \u653b\u51fb**\u4ecd\u5728\u8fdb\u884c**\uff1b\u5386\u53f2\u66b4\u9732\u7a7a\u95f4\u53ef\u80fd\u672a\u626b\u5b8c |\n| \u9644\u52a0\u4ef7\u503c | \u5168\u884c\u4e1a\u53ef\u5ba1\u8ba1\u540c\u7c7b\u95ee\u9898 | \u7ed9\u5382\u5546\u8865\u4e01 + \u7528\u6237\u8fc1\u79fb\u7559\u51fa\u65f6\u95f4\u7a97\u53e3 |\n\n\u7ed3\u8bba\uff1a**\u300c\u6015\u574f\u4eba\u5b66\u53bb\u300d\u5728\u653b\u51fb\u8fdb\u884c\u65f6\u662f\u771f\u5b9e\u8003\u91cf**\u2014\u2014\u5b89\u5168\u793e\u533a\u7528\u5206\u9636\u6bb5\u62ab\u9732\u6765\u5e73\u8861\uff0c\u800c\u975e\u6c38\u4e0d\u516c\u5f00\u3002\u62ab\u9732\u7b56\u7565\u7684\u5dee\u5f02\u7531\u653b\u51fb\u8fdb\u5ea6\u51b3\u5b9a\uff0c\u800c\u975e\u6280\u672f\u6df1\u5ea6\u3002\n\n---\n\n## \u4e94\u3001\u7ed9\u7528\u6237\u7684\u5b9e\u64cd\u5efa\u8bae\uff08\u6309\u4f18\u5148\u7ea7\uff09\n\n1. **\u7acb\u5373\u81ea\u67e5**\uff1a\u82e5\u7528\u8fc7 Coldcard\uff08Mk2/Mk3 \u56fa\u4ef6 4.0.0\u20134.1.9\u3001Mk4/Mk5 < 5.6.0\u3001Q < 1.5.0Q\uff09\uff0c\u6216\u7591\u4f3c\u7528\u8fc7\u5c0f\u4f17\u79fb\u52a8\u94b1\u5305\u2014\u2014\u7528\u5b98\u65b9/\u7814\u7a76\u56e2\u961f\u63d0\u4f9b\u7684\u5730\u5740\u68c0\u67e5\u5668\u67e5\u8be2\uff08\u53ea\u8f93\u5165\u516c\u5f00\u5730\u5740\uff0c**\u7edd\u4e0d\u8f93\u5165\u52a9\u8bb0\u8bcd**\uff09\u3002\n2. **\u8fc1\u79fb\u800c\u975e\u4fee\u8865**\uff1a\u547d\u4e2d\u5373\u751f\u6210\u5168\u65b0\u52a9\u8bb0\u8bcd\uff08\u5728\u65b0\u56fa\u4ef6/\u65b0 App \u4e0a\uff09\u5e76\u8f6c\u79fb\u5168\u90e8\u8d44\u91d1\u3002**\u66f4\u65b0\u8f6f\u4ef6 \u2260 \u4fee\u590d\u65e7\u5bc6\u94a5**\u3002\n3. **\u786c\u4ef6\u94b1\u5305 \u2260 \u514d\u75ab**\uff1aColdcard \u5df2\u8bc1\u660e\u786c\u4ef6\u94b1\u5305\u540c\u6837\u4f1a\u71b5\u584c\u7f29\u3002\u4efb\u4f55\u58f0\u79f0\u300c\u7edd\u5bf9\u5b89\u5168\u300d\u7684\u5b58\u50a8\u65b9\u6848\u90fd\u5e94\u88ab\u6000\u7591\u3002\n4. **\u52a0\u4e00\u5c42 BIP-39 passphrase**\uff1a\u72ec\u7acb\u751f\u6210\u7684\u5f3a passphrase \u4f1a\u8ba9\u300c\u52a9\u8bb0\u8bcd + passphrase\u300d\u5171\u540c\u6784\u6210\u5bc6\u94a5\u2014\u2014\u5373\u4f7f\u52a9\u8bb0\u8bcd\u6cc4\u9732\uff0c\u6ca1\u6709 passphrase \u4e5f\u65e0\u6cd5\u53d6\u5e01\uff08\u6ce8\u610f\uff1apassphrase \u4e22\u5931=\u8d44\u4ea7\u6c38\u4e45\u4e22\u5931\uff0c\u9700\u81ea\u884c\u6743\u8861\uff09\u3002\n5. **\u71b5\u6e90\u5ba1\u67e5**\uff1a\u5173\u952e\u8d44\u4ea7\u7684\u94b1\u5305\u751f\u6210\u8def\u5f84\u5e94\u53ef\u5ba1\u8ba1\u2014\u2014\u77e5\u9053\u968f\u673a\u6570\u6765\u81ea\u54ea\u91cc\u3001\u7528\u7684\u662f\u54ea\u4e2a\u5e93\u3001\u7248\u672c\u662f\u591a\u5c11\u3002\n6. **\u5206\u6563\u5b58\u50a8**\uff1a\u5927\u989d\u8d44\u4ea7\u4e0d\u8981\u96c6\u4e2d\u5728\u5355\u4e00\u52a9\u8bb0\u8bcd\u4e0b\uff1b\u591a\u7b7e\uff08multisig\uff09\u53ea\u6709\u5728\u5176\u7b7e\u540d\u8bbe\u5907**\u5168\u90e8**\u5b89\u5168\u65f6\u624d\u6709\u6548\u3002\n\n---\n\n## \u516d\u3001\u7ed3\u8bed\n\n\u8fd9\u56db\u8d77\u4e8b\u4ef6\u7684\u5171\u540c\u53d9\u4e8b\u662f\uff1a**\u4fe1\u4efb\u4e00\u4e2a\u300c\u5b89\u5168\u300d\u7684\u5de5\u5177\uff0c\u6bd4\u4fe1\u4efb\u4e00\u4e2a\u300c\u4e0d\u5b89\u5168\u300d\u7684\u5de5\u5177\u66f4\u5371\u9669\u3002** \u51b7\u94b1\u5305\u7684\u300c\u51b7\u300d\u3001\u6559\u6750\u7684\u6743\u5a01\u63a8\u8350\u3001\u5927\u5382\u7684\u54c1\u724c\u80cc\u4e66\u2014\u2014\u5168\u90fd\u65e0\u6cd5\u66ff\u4ee3\u5bf9\u968f\u673a\u6570\u6765\u6e90\u7684\u5ba1\u8ba1\u3002\u71b5\u584c\u7f29\u662f\u5bc6\u7801\u5b89\u5168\u4e2d\u6700\u96be\u505a\u5bf9\u3001\u4e5f\u6700\u96be\u88ab\u53d1\u73b0\u641e\u9519\u7684\u73af\u8282\u3002**\u5f53\u4f60\u7684\u5bc6\u94a5\u751f\u6210\u4f9d\u8d56\u67d0\u4e2a\u672a\u7ecf\u5ba1\u8ba1\u7684\u968f\u673a\u6570\u6e90\u65f6\uff0c\u4f60\u7684\u8d44\u4ea7\u5b89\u5168\u4e0d\u53d6\u51b3\u4e8e\u4f60\u4fdd\u7ba1\u5f97\u591a\u597d\uff0c\u800c\u53d6\u51b3\u4e8e\u8fd9\u4e2a\u968f\u673a\u6570\u6e90\u6709\u6ca1\u6709\u51fa\u8fc7 1 \u4e2a bug\u3002**\n\n---\n\n## \u9644\u5f55\uff1a\u4fe1\u606f\u6e90\n\n### Coldcard \u4e8b\u4ef6\n- Solidot \u7b80\u8baf\uff1ahttps://www.solidot.org/story?sid=84990\n- CoinDesk \u6df1\u5ea6\u62a5\u9053\uff08\u4e09\u6ce2\u6e05\u626b\u624b\u6cd5\uff09\uff1ahttps://www.coindesk.com/tech/2026/08/02/bitcoin-cold-wallet-attack-spreads-to-4-500-addresses-as-losses-near-usd89-million\n- The Hacker News\uff08\u5b8f\u68c0\u67e5\u6839\u56e0\u3001\u56fa\u4ef6\u7248\u672c\u8868\u3001Block \u9006\u5411\uff09\uff1ahttps://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html\n- Slashdot \u6c47\u603b\uff08Chainalysis \u53d6\u8bc1\u3001\u635f\u5931\u89c4\u6a21\uff09\uff1ahttps://it.slashdot.org/story/26/08/02/0145226/recovery-seeds-reportedly-breached-for-coldcard-hardware-bitcoin-wallets-75m-taken\n\n### Ill Bloom \u4e8b\u4ef6\uff08Coinspect \u7814\u7a76\uff09\n- \u5b98\u7f51 / \u81ea\u67e5\u5de5\u5177\uff1ahttps://illbloom.org/\n- \u6570\u636e\u96c6\u6784\u5efa\u65b9\u6cd5\u8bba\uff08Stage 1/2\u3001\u6d3e\u751f\u8def\u5f84\u8868\uff09\uff1ahttps://illbloom.org/articles/ill-bloom-address-set-1-methodology/\n- \u4e24\u6ce2\u6e05\u626b\u94fe\u4e0a\u5206\u6790\uff1ahttps://illbloom.org/articles/chain-analysis/ \u3001https://illbloom.org/articles/chain-analysis-2/\n- Techtimes \u62a5\u9053\uff1ahttps://www.techtimes.com/articles/319796/20260706/crypto-wallets-lose-5m-broken-random-number-generator-ill-bloom-disclosure.htm\n\n### Milk Sad \u4e8b\u4ef6\uff08CVE-2023-39910\uff09\n- \u5b98\u65b9\u7ad9\u70b9 / \u62ab\u9732\u6458\u8981\uff1ahttps://milksad.info/ \uff08\u542b cve_2023_39910_summary.html\u3001faq.html\uff09\n- \u6df1\u5ea6\u6280\u672f\u535a\u5ba2\uff08Christian Reitter\uff09\uff1ahttps://blog.inhq.net/posts/milk-sad-vuln1/\n- CWE-338 \u53c2\u8003\uff1ahttps://cwe.mitre.org/data/definitions/338.html\n\n### Trust Wallet \u4e8b\u4ef6\n- Ledger \u5b98\u65b9\u535a\u5ba2\uff08\u786e\u8ba4\u6d4f\u89c8\u5668\u6269\u5c55\u6f0f\u6d1e\uff09\uff1ahttps://www.ledger.com/blog/Funds-of-every-wallet-created-with-the-Trust-Wallet-browser-extension-could-have-been-stolen\n\n### \u76f8\u5173\u80cc\u666f\n- Mersenne Twister \u52a3\u52bf\u8bf4\u660e\uff08Wikipedia\uff09\uff1ahttps://en.wikipedia.org/wiki/Mersenne_Twister#Disadvantages", "creation_timestamp": "2026-08-04T18:23:34.710591Z"}, {"uuid": "3d991e22-3718-4106-8d08-f346954315ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39910", "type": "seen", "source": "https://t.me/GithubRedTeam/85516", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a RingSide-Replay-Attack\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hitplus\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-23 07:03:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udd12 Analyze the CVE-2023-39910 vulnerability in Libbitcoin Explorer to understand its impact on Bitcoin wallet security and protect your assets.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-23T07:07:39.000000Z"}, {"uuid": "8dd0727d-5bd1-4d6a-a936-861ada819286", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39910", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8a777a8e-1ae4-4a42-a3a6-3be53ffcb122", "content": "", "creation_timestamp": "2026-06-19T12:46:50.611067Z"}, {"uuid": "6b6ea555-2100-4c58-bc1d-043615eeeb76", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-39910", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/39840e7a-d283-4599-ae3c-9833e9fa4fe5", "content": "", "creation_timestamp": "2026-06-23T14:04:04.899428Z"}]}