Mullvad exit IPs enable user fingerprinting

Mullvad's predictable IP allocation exposes a massive privacy loophole, proving that even "secure" VPNs can be undermined by subtle implementation flaws in their random number generation.

• –Users are assigned IPs at a consistent percentile within any server's pool, creating a global fingerprint
• –The flaw stems from using the WireGuard public key as a static seed for Rust-based PRNGs
• –Observers can track users as they switch servers, defeating the purpose of multi-hop or server-hopping for anonymity
• –Demonstrates the risks of deterministic logic in privacy-focused infrastructure
• –Manual key rotation is the only current mitigation, as the app lacks automated cycling