critical severity ยท published 2026-07-10
Version 1.20.21 sends your BIP-39 mnemonic phrase and hex private keys to an attacker whenever you derive a wallet key. Treat every wallet secret on that machine as compromised.
Source: GitHub Advisory
Fixlane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the Fixlane MCP server and call get_fix_prompt with incident id 2007 and your operating system.