CryptoJS entropy flaw tied to $5.69 million in crypto wallet drains

Blockchain security firm Coinspect has linked the Ill Bloom wallet-drain campaign to CryptoJS.lib.WordArray.random(), a weak random-number generator used by five crypto wallet applications to create recovery phrases. Its on-chain analysis measured $5,690,922 in thefts through July 13 across two sweeps, a figure it describes as a lower bound.

The named applications are RRWallet, Bexo Wallet, NanChat, Bitcoin Libre and Milo. Coinspect said RRWallet and Milo are discontinued and have no fix. NanChat confirmed that versions before 1.3.0 were affected and fixed the issue in version 1.3.0. Bitcoin Libre fixed it in version 4, released in July 2024, while Bexo Wallet's fix is version 20.1.0, although Coinspect said updated builds had not yet been uploaded.

Weak entropy made recovery phrases enumerable

Recovery phrases should begin with 128-bit or 256-bit entropy, providing search spaces of 2^128 or 2^256. Coinspect found that the vulnerable generator reduced those spaces to approximately 2^39 and 2^47, making enumeration feasible on ordinary hardware.

The firm reproduced the attack path by generating possible outputs, converting them into BIP39 phrases, deriving wallet addresses and checking those addresses against public blockchain records. It tracked 2,114 identified seeds and associated addresses on Bitcoin, Ethereum, Tron, Rootstock and Polygon.

The first sweep, on May 27, took about $3.14 million from 431 accounts. A second campaign between May 30 and July 13 took $2.55 million from addresses associated with 522 seeds, including about 2.18 million USDT from one Tron account on July 4.

Package history and wallet exposure

CryptoJS introduced a Multiply-With-Carry generator seeded from Math.random() in June 2014. Versions 3.2.0 and 3.2.1 moved to native cryptographic randomness, but version 3.3.0 restored the weak implementation because the change was considered breaking. CryptoJS 4.0.0 restored native randomness permanently in February 2020.

Maintainer Evan Vosberg published advisory GHSA-rg76-677x-56q9 on August 5 with a Critical rating and CVSS score of 9.0. The advisory lists releases below 4.0.0, while noting that an application is exposed only when it uses the vulnerable function to generate security-sensitive values. Carrying the dependency alone does not make an application exploitable.

Coinspect identified ferrumnet/bip39, a React Native fork that replaced upstream bip39 native cryptographic randomness with CryptoJS, as one route into wallet software. The broader pattern of trust being inherited through software components also echoes third-party trust assumptions in security, where third-party assumptions can become an operational security exposure.

Migration matters more than an update

Updating a wallet application does not repair a recovery phrase generated with insufficient entropy. Hashing, PBKDF2 processing or importing that phrase into a hardware wallet also cannot restore the missing randomness. Coinspect said hardware-generated seeds and most current software wallets are unaffected.

NanChat advises users who created wallets before version 1.3.0 to consider them compromised and migrate; its version 1.3.0 includes a tool to create a new seed and move funds. For businesses and individuals, the practical implication is to identify affected seed-generation paths, create a new recovery phrase securely, transfer assets, and follow the active wallet provider's official migration guidance.