CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps

Summary

A vulnerability in the CryptoJS JavaScript cryptography library's random number generator, present for over a decade, has been linked to the theft of at least $5.7 million from five cryptocurrency wallet applications. The weak entropy affected the generation of recovery phrases, making them guessable and allowing attackers to drain funds. While some wallets have been fixed, others are discontinued, and users with affected phrases must move their funds to new, securely generated ones.

Full text

CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps Swati KhandelwalAug 06, 2026Vulnerability / Blockchain Coinspect has identified CryptoJS.lib.WordArray.random() as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScript cryptography library 12 years ago, the function supplied weak entropy that affected wallet apps used to generate recovery phrases. Coinspect's on-chain analysis puts the measured theft across two sweeps since late May at a lower bound of roughly $5.7 million. The blockchain security firm, which coined the Ill Bloom name in July, has now confirmed five applications that used the generator as an entropy source for recovery-phrase generation: RRWallet, which Coinspect says is discontinued. No fix. Bexo Wallet, which Coinspect says has been fixed in version 20.1.0, although the updated builds had not yet been uploaded. NanChat, which independently confirmed versions before 1.3.0 were affected. Fixed in 1.3.0. Bitcoin Libre, which Coinspect says fixed the issue in version 4, released July 2024. Milo, which Coinspect says is discontinued. No fix. Coinspect told The Hacker News that these are the same five wallets it referenced without naming in July. The firm said the vendor behind the browser extension mentioned in July told it that the extension had been discontinued and was never widely used. Coinspect cautioned that it cannot confirm it identified every vulnerable wallet. Other affected mobile or browser-extension wallets may also have existed but could not be examined because they had already been removed from app stores or extension marketplaces, or because vendors had replaced them with patched releases and the older vulnerable versions were no longer available. The public disclosure does not provide complete affected-version ranges for RRWallet, Bexo, Bitcoin Libre, or Milo. Updating the app does not repair an existing phrase. A recovery phrase generated by an affected version remains guessable wherever it is imported, including into a hardware wallet. Users whose phrases came from an affected path need to create a new one securely and move the funds. Coinspect says hardware-generated seeds and most current software wallets are unaffected. Coinspect analyzed 128- and 256-bit entropy. Those should yield search spaces of 2^128 and 2^256, but the vulnerable generator reduced them to roughly 2^39 and 2^47, small enough to enumerate on ordinary hardware. The firm reproduced the attack chain by enumerating outputs, converting them into BIP39 phrases, deriving addresses, and checking them against public blockchain data. The library fixed this once, then took the fix back out. The Multiply-With-Carry generator, seeded from Math.random(), arrived in June 2014. Releases 3.2.0 and 3.2.1 switched to native cryptographic randomness, but 3.3.0 restored the weak code because the change was considered breaking. An upgrade within 3.x could therefore move a project from a fixed release to a vulnerable one. Version 4.0.0 restored native randomness permanently in February 2020. Coinspect identified ferrumnet/bip39, a React Native fork that replaced upstream bip39's native cryptographic randomness with CryptoJS, as one route into wallet software, not the only one. CryptoJS maintainer Evan Vosberg published GHSA-rg76-677x-56q9 on August 5 with a Critical rating and a CVSS score of 9.0. Its package field lists every release below 4.0.0, despite the 3.2.0 and 3.2.1 exceptions. The advisory says an application is affected only if it uses the vulnerable function to generate security-sensitive values. Carrying the dependency alone does not satisfy that condition, so the package range is broader than the set of exploitable applications. Once a recovery phrase has been generated from the function's output, subsequent hashing or PBKDF2 processing cannot restore the missing entropy, nor can a later package update. Coinspect says the flaw was exploited in two drain waves. A May 27 sweep took about $3.14 million from 431 accounts. A second run between May 30 and July 13 took $2.55 million from addresses tied to 522 seeds, including roughly 2.18 million USDT from one Tron account on July 4. The later analysis tracks 2,114 identified seeds and associated addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon. Together, the analyses put measured losses at $5,690,922 through July 13, which Coinspect describes as a lower bound. Coinspect estimated from blockchain data that the affected population runs into the thousands across Ethereum Virtual Machine (EVM)-compatible networks and Bitcoin, but did not provide a wallet-by-wallet breakdown. As of August 6, NanChat was the only named application found to have published a public advisory. Coinspect told The Hacker News that Bexo's 20.1.0 fix is not platform-specific, but that the updated builds had not yet been uploaded. The Hacker News checked Bexo's official store records on August 6. Apple's App Store listed version 18.3.5 as the current iPhone release, while Google Play showed an Android update on May 20 but no public version number. Neither listing confirmed that version 20.1.0 was available at the time of review. Coinspect advised users of wallets that remain active to consult the projects' official channels for current version and migration guidance. The Hacker News has also contacted Bexo for clarification. NanChat's advisory tells users who created a wallet before v1.3.0 to consider it compromised and migrate. Version 1.3.0 includes a tool to generate a new seed and move the funds. Coinspect founder and CEO Juliano Rizzo reported the issue on June 10; the fix shipped two days later. Coinspect said it withheld the technical details for two months while notifying vendors and searching for exposed addresses. Coinspect's public checker accepts wallet addresses, not recovery phrases or private keys. A match means assets tied to the same phrase may be at immediate risk. A negative result only means the address is not in the currently published datasets. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Application Security, Blockchain, cryptocurrency, cryptography, Cybercrime, JavaScript, mobile security, Open Source, Software Security, Vulnerability ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the B

Entities