CryptoJS Weak RNG Linked to $5.7 Million in Crypto Wallet Drains
A decade-old flaw in the CryptoJS library's random number generator has been exploited to steal over $5.7 million from five cryptocurrency wallet applications.
A critical vulnerability stemming from a weak random number generator within the widely-used CryptoJS JavaScript library has been identified as the root cause behind the theft of at least $5.7 million from five cryptocurrency wallet applications. The flaw, specifically in the CryptoJS.lib.WordArray.random() function, has been present for over a decade and supplied insufficient entropy for generating secure recovery phrases, commonly known as seed phrases.
Coinspect, a blockchain security firm, has been tracking these incidents and coined the "Ill Bloom" name for the associated theft campaigns. Their on-chain analysis revealed two major theft sweeps occurring since late May 2026, with the total estimated losses reaching a lower bound of approximately $5.7 million. The vulnerability allowed attackers to enumerate potential recovery phrases, which should have had astronomically large search spaces but were reduced to manageable sizes – roughly 2^39 and 2^47 for 128-bit and 256-bit entropy respectively – making them guessable on ordinary hardware.
Five specific wallet applications have been confirmed to have used the vulnerable generator for their recovery phrase generation: RRWallet (discontinued, no fix available), Bexo Wallet (fixed in v20.1.0, but updated builds not yet uploaded), NanChat (fixed in v1.3.0), Bitcoin Libre (fixed in v4, released July 2026), and Milo (discontinued, no fix available). Coinspect noted that these are the same five wallets referenced without naming in a previous July disclosure.
While some applications have released patches, updating the app does not repair an existing, compromised recovery phrase. Any phrase generated by a vulnerable version remains guessable, even if imported into a hardware wallet. Users who generated their recovery phrases using an affected version are strongly advised to create a new, securely generated phrase and migrate their funds immediately. Hardware-generated seeds and most current software wallets are generally considered unaffected.
The vulnerability's history is complex. The weak Multiply-With-Carry generator, seeded from Math.random(), was introduced around June 2014. While releases 3.2.0 and 3.2.1 temporarily switched to native cryptographic randomness, version 3.3.0 reverted to the flawed code due to concerns about breaking changes. A permanent fix restoring native randomness was only implemented in version 4.0.0 in February 2020. This means applications upgrading within the 3.x series could have inadvertently moved from a patched to a vulnerable state.
Coinspect identified ferrumnet/bip39, a React Native fork that replaced the upstream bip39 library's native randomness with CryptoJS, as one pathway into vulnerable wallet software, though not the only one. The official CryptoJS advisory, GHSA-rg76-677x-56q9, rates the issue as Critical with a CVSS score of 9.0, affecting all releases below 4.0.0, with exceptions for 3.2.0 and 3.2.1.
The firm withheld technical details for two months to allow vendors to address the issue and to identify exposed addresses. The two identified theft waves on May 27 and between May 30 and July 13, 2026, targeted thousands of accounts across multiple blockchains including Bitcoin, Ethereum, Tron, Rootstock, and Polygon. Coinspect estimates the affected user base could number in the thousands across various EVM-compatible networks and Bitcoin.
As of early August 2026, NanChat was the only named application to have published a public advisory. Coinspect urges users of any potentially affected wallets to consult official project channels for guidance on version status and migration procedures. The security firm's public checker tool can help identify if an address is linked to a compromised seed.