CryptoJS Weak RNG Behind $5.7M Crypto Wallet Drains Across 5 Apps

Blockchain security firm Coinspect has confirmed that the weak random number generator in CryptoJS.lib.WordArray.random() was responsible for the "Ill Bloom" wallet drains that have stolen at least $5.7 million since late May. The JavaScript cryptography library, which introduced the Multiply-With-Carry generator seeded from Math.random() in June 2014, supplied entropy so weak that recovery phrases generated by affected wallet apps could be brute-forced on ordinary hardware. Coinspect's analysis showed that 128- and 256-bit entropy were effectively reduced from expected search spaces of 2^128 and 2^256 down to roughly 2^39 and 2^47, small enough to enumerate by converting outputs into BIP39 phrases and checking derived addresses against public blockchain data.

Five wallet applications have been named as affected: RRWallet (discontinued, no fix), Bexo Wallet (fixed in version 20.1.0), NanChat (fixed in version 1.3.0), Bitcoin Libre (fixed in version 4, released July 2024), and Milo (discontinued, no fix). Coinspect cautioned that it could not confirm it identified every vulnerable wallet, noting that other affected mobile or browser-extension wallets may have existed but were already removed from app stores or replaced with patched releases. The library's patch history further compounds the risk: versions 3.2.0 and 3.2.1 switched to native cryptographic randomness, but 3.3.0 reverted the change because it was deemed breaking, meaning an upgrade within the 3.x branch could move a project from a fixed release back to a vulnerable one. Version 4.0.0 ultimately restored native randomness permanently.

Users who generated recovery phrases with affected versions must understand that updating the app does not repair an existing phrase. Any previously generated seed remains guessable wherever it has been imported, including into hardware wallets, and must be replaced with a securely generated one before funds are moved. Coinspect emphasized that hardware-generated seeds and most current software wallets are unaffected. The disclosure underscores how a single weak entropy source in a widely used library can compromise millions in user assets across multiple independent applications, and serves as a reminder to audit the cryptographic foundations of any tool entrusted with key material. Users managing cryptocurrency should run a privacy checkup on their devices and verify the integrity of any stored recovery phrases using a trusted password checker to assess their exposure to similar weak-RNG vulnerabilities.