Mullvad leak: only 284 exit-IP combinations instead of trillions

A researcher writing as tmctmt found that Mullvad picks exit IPs deterministically from a single seeded float tied to the WireGuard key. Instead of 8.2 trillion combinations across 578 servers, 3,650 tested keys produced just 284 distinct sets across nine servers. Mullvad's co-founder confirmed part of the behavior was intentional and said a patch is rolling out.

• 3,650 WireGuard keys yielded only 284 distinct exit-IP sets across 9 servers
• Pool sizes: Sydney 60 IPs, Helsinki 66, Los Angeles 91, Santiago 11
• Nine observed exit IPs narrow the float interval to 0.0034 — about 340 of 100,000 users
• Mullvad is patching the unintended part on a subset of the fleet