Bitcoin private key generation command line tool "bx seed" may have a weak randomness vulnerability, which has been fixed

Odaily Planet Daily News The milksad.info team recently published a document stating that on July 21, a weak randomness vulnerability was found in Bitcoin libbitcoin-explorer (command line tool bx). Currently, the GitHub page shows that the vulnerability has been fixed today and the "bx seed" command has been removed. When the "bx seed" tool generates mnemonics, it only uses the system time as the source of randomness, so it can only generate one of about 4 billion mnemonics, and it is easy for an attacker to regenerate. The team found more than 2,600 highly active bitcoin wallets based on "bx seed" entropy, all of which had similar small deposits in 2018. Cake Wallet and Trust Wallet also have similar vulnerabilities, and other wallets are not affected by this vulnerability. The hack began on May 3, 2023, and included multiple smaller wallet scans, and continued until July 15. The heaviest theft occurred on July 12, with a total of 29.65 BTC stolen, worth approximately $870,000. According to the article, at least about $900,000 in stolen assets have been transferred, including BTC, ETH, XRP, DOGE, SOL, LTC, BCH, and ZEC. Also, it is possible that some public theft exploited a random number generator issue in versions prior to bx 3.0.0, but the milksad.info team has not confirmed this and plans to conduct further research on this basis.