The Bitcoin private key generation command line tool "bx seed" has a significant vulnerability due to weak randomness, which has now been fixed
ChainCatcher news, the milksad.info team stated that on July 21, a significant vulnerability named "milk sad" was discovered in the Bitcoin libbitcoin-explorer (command line tool bx). Currently, the GitHub page shows that the vulnerability has been fixed today and the "bx seed" command has been removed.The "bx seed" tool generates mnemonic phrases using only the system time as a source of randomness, which means that "bx seed" can only generate one out of approximately 4 billion mnemonic phrases, making it easy for attackers to regenerate these 4 billion mnemonic phrases. The team found over 2,600 Bitcoin wallets that were highly active and based on "bx seed" entropy, all of which had similar small deposits in 2018. Cake Wallet and Trust Wallet also have similar vulnerabilities, while other wallets were not affected by this vulnerability.The vulnerability was exploited by hackers on May 3, with the most severe theft occurring on July 12, totaling 29.65 BTC stolen, worth approximately $870,000. The article states that at least about $900,000 in stolen assets has been transferred. Additionally, not only BTC, but ETH, XRP, DOGE, SOL, LTC, BCH, and ZEC tokens have also been confirmed as stolen. The article mentions that when it sent detailed information about the technical vulnerability to the Libbitcoin team, they responded twice, stating that they did not consider it a vulnerability. Meanwhile, "bx seed" also appears in the book "Mastering Bitcoin," which previously did not warn users that "bx seed" cannot generate secure random numbers; the milksad team has notified the book's author for modifications.