A flawed random number generator built into a widely used JavaScript cryptography library 12 years ago has resulted in at least $5.7 million stolen from cryptocurrency wallets, according to a new analysis published by blockchain security firm Coinspect. The firm identified CryptoJS.lib.WordArray.random() as the vulnerability behind what it calls the "Ill Bloom" wallet drains, which affected applications that relied on the function to create recovery phrases. The weak entropy supplied by the function left thousands of users vulnerable to attackers who could simply guess their supposedly secure phrases.
Coinspect's blockchain forensics tracked two waves of theft beginning in late May. The first sweep on May 27 drained approximately $3.14 million from 431 accounts, while a second attack between May 30 and July 13 took $2.55 million from addresses linked to 522 seed phrases, including roughly $2.18 million in USDT from a single Tron account on July 4. The investigation traced 2,114 compromised seed phrases across Bitcoin, Ethereum, Tron, Rootstock, and Polygon networks through July 13. The measured losses of $5,690,922 represent what Coinspect describes as a lower bound, with blockchain data suggesting the affected population numbers in the thousands across EVM-compatible networks and Bitcoin.
Coinspect confirmed five wallet applications used the vulnerable generator as an entropy source: RRWallet (discontinued, no fix), Bexo Wallet (fixed in version 20.1.0, though updated builds hadn't been uploaded as of early August), NanChat (fixed in version 1.3.0 after independently confirming earlier versions were affected), Bitcoin Libre (patched in version 4 released July 2024), and Milo (discontinued, no fix). The firm told The Hacker News these are the same five wallets it referenced without naming in July, and cautioned it cannot confirm it identified every vulnerable application. As of August 6, NanChat was the only named wallet to have published a public advisory, telling users who created wallets before version 1.3.0 to treat them as compromised and migrate funds using a new seed-generation tool included in the update.
The vulnerability stems from the library's reliance on a Multiply-With-Carry generator seeded from JavaScript's Math.random(), which arrived in June 2014. Coinspect's analysis shows that 128-bit and 256-bit entropy should produce search spaces of 2^128 and 2^256, but the weak generator collapsed them to roughly 2^39 and 2^47—small enough to enumerate on standard hardware. CryptoJS releases 3.2.0 and 3.2.1 switched to native cryptographic randomness, but version 3.3.0 rolled the fix back because the change was deemed breaking, meaning an upgrade within the 3.x line could inadvertently move a project from a patched release to a vulnerable one. Version 4.0.0 restored native randomness permanently in February 2020, and maintainer Evan Vosberg published a critical security advisory on August 5 with a CVSS score of 9.0, noting an application is affected only if it uses the vulnerable function to generate security-sensitive values.
The report stresses that updating an app doesn't repair an existing recovery phrase—any phrase generated by an affected version remains guessable wherever it's imported, including into a hardware wallet, and users whose phrases originated from a compromised path must create a new one securely and transfer their funds. Coinspect told The Hacker News that other affected mobile or browser-extension wallets may have existed but couldn't be examined because they'd already been pulled from app stores or replaced with patched releases that obscured the older vulnerable versions. The firm's public checker accepts wallet addresses to flag immediate risk, though a negative result only means the address isn't in the currently published datasets. For an industry built on the promise of cryptographic certainty, the episode reveals how legacy dependencies can silently undermine security long after they're introduced, and why routine code audits must extend beyond an application's own codebase to the libraries it trusts.