Trust Wallet Weak Entropy

In 2023 a bug in the Trust Wallet browser extension (CVE-2023-31290, the "Trust Wallet X" class) let the mnemonic generator fall back to Math.random() — and V8's Math.random is an MT19937 generator whose state comes from a tiny 32-bit seed. Every 12-word mnemonic it produced was therefore brute-forceable from that one number. This tool models that collapse: a 32-bit seed drives a standard MT19937, the first 4 outputs (128 bits) become the real BIP-39 entropy, and the full PBKDF2 + BIP-32 pipeline derives the wallet. Verify a seed to see its mnemonic and addresses, or scan a seed range to recover the wallet behind a target address. Every hit is verified by regenerating the address. Everything runs in your browser.

bitcoin
Paste a wallet address for the selected chain and brute-force the 32-bit MT19937 seed range below — each seed runs the full BIP-39 + PBKDF2 + BIP-32 pipeline, so keep ranges modest.
to the full space is 0–232−1 (a GPU job); each seed needs PBKDF2, so scan slices of a few thousand
derives the mnemonic + addresses for one seed (instant)
Scope: this models the class of failure behind CVE-2023-31290 — the wallet RNG collapsed to a single 32-bit seed that determines the whole BIP-39 mnemonic — not a byte-exact reproduction of the specific Trust Wallet extension build, so it will not recover real historical wallets without the exact wallet-creation parameters. It recovers any wallet generated under this model and demonstrates why 32-bit seeding is catastrophic. 
Instructions:
1. Verify a seed — type a 32-bit seed (e.g. 1337) and press "Verify seed" to derive the MT19937 entropy, the real 12-word BIP-39 mnemonic, the PBKDF2 BIP-39 seed and the chain's BIP-44 first address (m/44'/coin'/0'/0/0).
2. Scan a range — paste a wallet address for the selected chain and press "Scan range". The mnemonic and keys are recovered if the wallet was generated under the modeled weak-entropy collapse.
3. A wallet is shown only when its address regenerates from the derived key, so a match is verified, not guessed.
4. The full space is ~2^32 seeds; each seed needs PBKDF2 (2048 HMAC-SHA512), so scan in slices of a few thousand.
5. The BIP-39 wordlist is fetched once from assets/data/bip39-english.txt; everything else runs in your browser.
Educational tool — models a vulnerability class. This reproduces the effect of the Trust Wallet browser-extension weak-entropy bug (CVE-2023-31290): a wallet fully determined by a small 32-bit MT19937 seed, exhaustively brute-forcible. It is not a byte-exact reproduction of a specific Trust Wallet build, so it will not recover real historical wallets without the exact wallet-creation parameters — it recovers any wallet generated under this model and shows why 32-bit RNG seeding is catastrophic. Every recovered key is verified by regenerating the address; nothing is guessed. Never enter keys for wallets you use.