The National Institute of Standards and Technology (NIST), an agency under the United States Department of Commerce, is conducting an investigation into potential vulnerabilities within the iOS version of the Binance Trust Wallet app. This probe comes amidst concerns that a flaw in the app’s functionality could be exploited by malicious actors to steal funds from cryptocurrency wallets.

Investigation Triggers by Vulnerability Reports and Independent Findings

According to NIST, the vulnerability in question involves the misuse of the trezor-crypto library, leading to the generation of mnemonic words that are only verifiable at the entropy source. This misuse creates a potential loophole through which attackers could systematically generate mnemonics for specific wallet addresses within a certain timeframe, facilitating the unauthorized access and theft of funds.

The investigation was prompted by reports from CVE, a program sponsored by the US Department of Homeland Security, which highlighted the exploitation of a similar vulnerability in July 2023 resulting in significant economic losses. Secbit Labs, in collaboration with CVE, identified an older wallet generation weakness in the iOS platform version of Trust Wallet dating back to 2018, linking it to notable theft incidents in July 2023.

Trending Now: Bitcoin ETFs Gain Momentum as Gold Investments Decline

Independent investigations, including one conducted by Milk Sad, revealed the presence of at least 6,572 unique wallet mnemonics susceptible to potential loss of funds due to the vulnerability. Milk Sad’s investigation further alleged that the Trust Wallet app for iOS utilized open-source code for generating cryptocurrency wallets. Moreover, it employs unsafe functions within the trezor-crypto library not intended for production environments.

Binance Response and NIST Evaluation of Trust Wallet Vulnerability Severity

Despite repeated attempts to solicit a response from Binance media outlets, the company has yet to comment on the matter. However, a spokesperson for Binance clarified that Trust Wallet operates as a separate legal entity from the Binance group since its acquisition in 2018, emphasizing its independent operation from Binance.

The severity of the vulnerability will be assessed by NIST, with a base score ranging from 0 to 10. The investigation aims to provide insights into the real-world implications of the vulnerability and inform potential remedial actions to mitigate risks associated with the Binance Trust Wallet iOS app.