Blockchain security firm **Coinspect** has pinpointed a long-standing vulnerability in the **CryptoJS** library, specifically within its `CryptoJS.lib.WordArray.random()` function. This weak random number generator (RNG), present for over a decade, provided insufficient entropy for generating cryptocurrency wallet recovery phrases, making them susceptible to enumeration attacks. **Coinspect**'s on-chain analysis reveals that two distinct waves of theft since late May have siphoned at least $5.7 million from vulnerable wallets.  ### Identified Vulnerable Wallets **Coinspect** has confirmed five applications that utilized the compromised generator for recovery phrase creation: * **RRWallet**: Discontinued, no fix available. * **Bexo Wallet**: Reportedly fixed in version 20.1.0, though updated builds were not yet widely available as of early August. * **NanChat**: Versions before 1.3.0 were affected; fixed in 1.3.0. * **Bitcoin Libre**: Issue resolved in version 4, released July 2024. * **Milo**: Discontinued, no fix available. **Coinspect** cautions that this list may not be exhaustive, as other vulnerable wallets might have been removed or patched without public disclosure. ### The Mechanics of the Exploit The vulnerability dramatically reduced the cryptographic strength of recovery phrases. While 128-bit and 256-bit entropy should yield search spaces of 2^128 and 2^256 respectively, the flawed generator reduced these to approximately 2^39 and 2^47. These smaller search spaces are easily enumerable on standard computing hardware. **Coinspect** successfully reproduced the attack chain by enumerating outputs, converting them into **BIP39** phrases, deriving associated addresses, and cross-referencing them with public blockchain data. ### A Troubled History of the RNG The `CryptoJS.lib.WordArray.random()` function, which relies on a Multiply-With-Carry generator seeded from `Math.random()`, was introduced in June 2014. Interestingly, **CryptoJS** versions 3.2.0 and 3.2.1 temporarily switched to native cryptographic randomness. However, this change was reverted in version 3.3.0 due to concerns about it being a breaking change. It wasn't until version 4.0.0, released in February 2020, that native randomness was permanently restored. This meant that an upgrade within the 3.x branch could inadvertently move a project from a secure release to a vulnerable one. ### Financial Impact and Advisory The **Ill Bloom** attacks occurred in two primary waves: * **May 27 sweep**: Approximately $3.14 million stolen from 431 accounts. * **May 30 - July 13 run**: An additional $2.55 million taken from addresses linked to 522 seeds, including a significant 2.18 million **USDT** from a single **Tron** account. In total, **Coinspect**'s analysis, as of July 13, identifies measured losses at $5,690,922, which they state is a lower bound. The affected population is estimated to be in the thousands across **Ethereum Virtual Machine (EVM)**-compatible networks and **Bitcoin**. **CryptoJS** maintainer **Evan Vosberg** published **GHSA-rg76-677x-56q9** on August 5, assigning a Critical rating and a **CVSS** score of 9.0. This advisory lists all releases below 4.0.0 as potentially vulnerable, emphasizing that the application is affected only if it actively uses the function for security-sensitive value generation. ### User Guidance **Crucially, updating a vulnerable wallet application does not retroactively secure an existing recovery phrase.** Any phrase generated by an affected version remains guessable, even if imported into a hardware wallet. Users who generated recovery phrases with the identified vulnerable wallets are strongly advised to: 1. Generate a new recovery phrase using a securely patched or unaffected wallet. 2. Immediately move all funds from addresses associated with the compromised phrase to new addresses generated by the secure phrase. Hardware-generated seeds and most current software wallets are generally unaffected. **Coinspect**'s public checker tool allows users to input wallet addresses (not recovery phrases or private keys) to see if assets tied to them are at immediate risk, though a negative result does not guarantee complete safety from other attack vectors. **Coinspect** delayed public disclosure for two months to notify vendors and search for exposed addresses, allowing time for remediation and user migration guidance.