CVE-2023-31290 in Trust Wallet Core
Summary
by MITRE • 04/27/2023
Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input seed, resulting in only four billion possible mnemonics. The affected versions of the browser extension are 0.0.172 through 0.0.182. To steal funds efficiently, an attacker can identify all Ethereum addresses created since the 0.0.172 release, and check whether they are Ethereum addresses that could have been created by this extension. To respond to the risk, affected users need to upgrade the product version and also move funds to a new wallet address.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/24/2025
The vulnerability identified as CVE-2023-31290 represents a critical cryptographic weakness in Trust Wallet Core library versions prior to 3.1.1 and the associated Trust Wallet browser extension versions 0.0.172 through 0.0.182. This flaw stems from the implementation of the Mersenne Twister pseudorandom number generator algorithm with insufficient entropy, specifically utilizing only 32-bit seeding which dramatically reduces the cryptographic security of generated mnemonic phrases. The vulnerability manifests as a predictable entropy source that creates a finite set of possible mnemonic combinations, making the system susceptible to brute force attacks and systematic enumeration of potential wallet addresses.
The technical implementation of this vulnerability follows CWE-330 weakness pattern, specifically involving insufficient entropy in random number generation where the mt19937 Mersenne Twister algorithm receives a single 32-bit seed value instead of the recommended cryptographic strength entropy. This limitation results in only four billion possible mnemonic combinations, a computationally feasible number for attackers to enumerate and exploit. The attack vector leverages the deterministic nature of the pseudorandom number generator, where an attacker with knowledge of the vulnerable software version can systematically generate all possible Ethereum addresses that could have been created using the same flawed entropy source, effectively enabling them to identify and steal funds from affected wallets.
The operational impact of this vulnerability extends beyond simple financial loss to encompass broader security implications for cryptocurrency users and wallet providers. Attackers can efficiently identify all Ethereum addresses created since the vulnerable extension release by performing systematic enumeration of the limited entropy space, which aligns with ATT&CK technique T1583.001 for obtaining resources and T1005 for data from local system. The exploitation timeline demonstrates real-world impact occurring in December 2022 and March 2023, indicating that threat actors were actively monitoring and capitalizing on this vulnerability within months of its introduction. The attack methodology involves creating a comprehensive list of potential addresses, then systematically checking which ones contain funds, making this a highly targeted and efficient form of cryptocurrency theft.
Mitigation strategies for CVE-2023-31290 require both immediate and long-term security measures to address the compromised wallet states. Users must upgrade to Trust Wallet Core version 3.1.1 and the corresponding browser extension version 0.0.183 or later to receive proper cryptographic entropy implementation. The fundamental remediation involves transitioning from the flawed 32-bit seeding approach to properly implemented cryptographic random number generation that provides sufficient entropy for secure mnemonic generation. Additionally, affected users must transfer all funds to newly generated wallet addresses, as the compromised wallet states cannot be trusted for continued use. This vulnerability highlights the critical importance of proper entropy implementation in cryptographic systems and demonstrates how seemingly minor implementation flaws can result in substantial financial losses, reinforcing the necessity of rigorous security testing and adherence to established cryptographic best practices for wallet and cryptocurrency software development.