Weak CryptoJS RNG linked to $5.69M in wallet thefts

A flaw in a CryptoJS random-number function used by several wallet apps made some recovery phrases predictable and has been tied to at least $5.69 million in traced thefts since May. Security firm Coinspect traced the losses and said the figure is a lower bound.

Coinspect traced the vulnerable implementation to CryptoJS.lib.WordArray.random(), a change introduced in June 2014 to alter how randomness was produced. The firm found that the implementation reduced the effective search space for seed generation from the expected sizes of about 2^128 or 2^256 to roughly 2^39 and 2^47, making brute-force enumeration feasible for some phrases.

The firm identified three waves of attacks. Roughly $3.14 million was drained on May 27, about $2.55 million was taken between May 30 and July 13, and a third wave on July 20–21 targeted wallets using Chinese mnemonics and yielded around $40,000.

Coinspect named five wallet apps whose generation paths used the weak random function: RRWallet, Bexo Wallet, NanChat, Bitcoin Libre and Milo. Bexo corrected its generation path in version 20.1.0, NanChat in version 1.3.0 and Bitcoin Libre in version 4. RRWallet and Milo have been discontinued. NanChat advised users who created wallets before version 1.3.0 to consider those wallets compromised and to move funds to newly generated phrases.

The analysis covered more than 2,000 exposed seeds with on-chain activity on Bitcoin, Ethereum, Tron, Rootstock and Polygon. Coinspect said the published $5.69 million reflects only thefts it was able to trace and that additional affected wallets may not be in the published datasets.

A recovery phrase is a list of words that can recreate a wallet’s private keys and control its funds. When a phrase is generated with insufficient randomness, attackers can generate likely phrases, derive the corresponding blockchain addresses and check those addresses for balances. Because the weakness was in how phrases were created, installing an updated app does not secure phrases generated earlier; importing the same weak phrase into another wallet does not remove its exposure.

To help users check risk without sharing private keys, Coinspect released a tool called Unlukey that compares public blockchain addresses to known exposed datasets. A match indicates potential exposure; a non‑match only means the address was not found in the published set.

For wallets confirmed to be affected, the recommended action is to create a new recovery phrase using software that generates secure randomness and move funds controlled by the compromised phrase to the new wallet. Coinspect noted that the full scope of affected apps and total losses remain uncertain and that the reported figure covers only traced incidents identified so far.