A flaw in the CryptoJS random-number generator left recovery phrases from at least five crypto wallet applications predictable enough for attackers to reconstruct, contributing to at least $5.69 million in traced thefts since May.
Blockchain security firm Coinspect identified the vulnerability in RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo. The vulnerable implementation of CryptoJS.lib.WordArray.random() was introduced in June 2014 and significantly reduced the randomness of wallet recovery phrases.
Recovery phrases serve as a wallet's master backup and can be used to recreate the private keys controlling the wallet. The weak randomness made the effective search space for recovery phrases feasible to enumerate rather than computationally impractical. Coinspect found the vulnerable function reduced expected search spaces from 2^128 or 2^256 possibilities to roughly 2^39 and 2^47.
Attackers exploited this vulnerability across multiple waves: approximately $3.14 million was drained on May 27, another $2.55 million between May 30 and July 13, and around $40,000 between July 20 and 21. The analysis covered more than 2,000 seeds with activity across Bitcoin, Ethereum, Tron, Rootstock, and Polygon, making the $5.69 million total a lower bound rather than a complete accounting of losses.
Once a recovery phrase is compromised, updating the wallet application cannot fix the vulnerability. Affected users must generate a new recovery phrase securely and move their funds.
Some wallet developers have released patched versions: Bexo fixed the generation path in version 20.1.0, NanChat in version 1.3.0, and Bitcoin Libre in version 4. RRWallet and Milo have been discontinued. NanChat advised users who created wallets before version 1.3.0 to consider them compromised and migrate to a newly generated phrase.
Coinspect released a tool called Unlukey that allows users to check if their public blockchain addresses appear in known exposed datasets without submitting private information.
