Loading story…
CVE-2023-39910, known as Milk Sad, affects Libbitcoin Explorer (bx) versions 3.0.0 through 3.6.0. The bx seed command used the non-cryptographic MT19937 PRNG initialized from a 32-bit system-clock-derived value, reducing supposedly 128-, 192-, or 256-bit wallet entropy to no more than 2^32 possible states. Attackers can enumerate candidate seeds, derive BIP39/BIP32 wallets and addresses, and compare them against public blockchain activity without breaking secp256k1, BIP39, or BIP32 cryptography.
Researchers linked the weakness to suspicious 2023 wallet sweeps, including three transactions that moved approximately 29.65 BTC on July 12, and identified more than 2,600 used wallets in a limited Bitcoin-only search. Organizations and individuals that generated mnemonic phrases with affected bx seed releases should consider those wallets compromised, transfer assets to newly created wallets, and generate replacement entropy with an operating-system cryptographically secure PRNG.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Milk Sad published its technical disclosure describing how the vulnerable bx seed command limited reachable wallet-entropy outputs to at most 2^32 states, enabling practical enumeration of candidate wallets.
The entropy weakness affecting Libbitcoin Explorer bx versions 3.0.0 through 3.6.0 was assigned CVE-2023-39910.
Investigators reportedly discovered the Libbitcoin Explorer entropy-generation defect during an incident investigation. The flaw stems from bx seed using a clock-derived 32-bit seed for the non-cryptographic MT19937 PRNG.
A main cluster of three Bitcoin transactions moved approximately 29.65 BTC in suspicious sweeps. At August 2023 exchange rates, the transactions were worth more than US$850,000.
Suspicious small sweep operations associated with the Milk Sad weakness began appearing. The activity involved wallets whose entropy may have been generated by vulnerable Libbitcoin Explorer bx seed releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-39910** (“Milk Sad”) affected Libbitcoin Explorer (`bx`) versions 3.0.0 through 3.6.0 because its `bx seed` function initialized the non-cryptographic MT19937 pseudorandom-number generator with only 32 bits derived from the system clock. As a result, requests for 256-bit wallet entropy produced seeds drawn from a practical `2^32` search space, enabling attackers to reproduce affected BIP-39 mnemonics, derive private keys, and access associated cryptocurrency funds. The weakness has been linked to a July 2023 theft wave totaling roughly **29.65 BTC** and to thousands of potentially vulnerable active wallets, with exposure extending beyond Bitcoin to other cryptocurrencies using affected seeds. Organizations and users that generated wallets with impacted `bx` releases should treat those wallets as compromised candidates, move assets to newly created wallets, and generate replacement seed material using a cryptographically secure random source.
Sep 26, 2026
Attackers exploited a weakness dubbed **"Milk Sad"** in the `Libbitcoin Explorer 3.x` library to steal more than **$900,000** from cryptocurrency wallets whose seeds were generated with the `bx seed` command. Researchers said the flaw came from weak randomness during wallet-seed generation, allowing private keys to be guessed and funds drained; one reported theft exceeded **$278,318**. The issue was identified by the Distrust team, reported to the vulnerability database, and later publicized by blockchain security firm **SlowMist**, which said it worked with exchanges in an attempt to block the attacker’s address. The incident put renewed scrutiny on the long-running **Libbitcoin** project and raised concerns that exposure could extend beyond Bitcoin wherever the library was used to create accounts. Libbitcoin Institute member **Eric Voskuil** said the vulnerable command was not intended for production wallet use, and reports indicated the project could strengthen warnings or remove the feature. The thefts highlighted how insecure seed generation in developer tooling can translate directly into large-scale wallet compromise.
Jun 29, 2026
A flaw in **COLDCARD** hardware wallet firmware made some recovery seeds predictable, and attackers used the weakness to steal about **594.48 BTC**—roughly **$38 million**—from around **500 wallets** in a coordinated sweep lasting about **25 minutes**. Reporting tied the theft to wallets created on affected devices, with the losses spread across roughly 500 transactions in three blocks and most of the stolen funds—about **562 BTC**—later consolidated into a single address. The targeted wallets were reportedly **single-signature** wallets holding more than **0.15 BTC** each, and many had been dormant for years. The weakness was traced to firmware logic that failed to properly use the device hardware random number generator and instead relied on a predictable fallback with a **32-bit reseed** mechanism, reducing entropy in generated seeds. Coinkite said the issue affects **Mk3** devices running firmware **4.0.1 and later**, and also affects **Mk4, Mk5, and Q** devices that generated seeds before fixed firmware was released; the company urged users to update firmware, create entirely new seeds, and move funds because updating alone does not repair already weak seeds. Coinkite added that wallets protected with sufficient independent dice-roll entropy or a strong **BIP-39 passphrase** are better protected, while **TAPSIGNER**, **SATSCARD**, and **OPENDIME** are not affected.
Aug 11, 2026