A 12-year-old flaw in a popular crypto library drained $5.7 million from wallets

Key points

• Coinspect blamed the wallet thefts on CryptoJS.lib.WordArray.random(), a random number generator built into the popular CryptoJS JavaScript library.
• The weak function has sat inside the library for roughly 12 years and produced predictable output when used to seed recovery phrases.
• Five cryptocurrency wallet apps relied on it, exposing users grouped under the "Ill Bloom" thefts.
• Coinspect measured at least $5.7 million stolen across two sweeps since late May 2024, and calls that a lower bound.
• Users of affected wallets should assume their recovery phrases are exposed and move funds to a freshly generated wallet.

Security researchers at Coinspect say they've found why a string of cryptocurrency wallets kept getting emptied. The culprit is CryptoJS.lib.WordArray.random(), a function buried inside CryptoJS, a widely used JavaScript toolkit for cryptography, meaning code that scrambles and protects data. Wallet apps called it to generate the secret "recovery phrase" that controls a user's coins. That function was added to the library about 12 years ago, and it produces numbers that aren't truly unpredictable. In cryptography, "weak entropy" means the randomness has patterns an attacker can guess. Reproduce the randomness, reproduce the recovery phrase, and the wallet is yours.

We first reported this campaign on 10 July 2026, when Coinspect had tracked losses to $3.1 million; the figure has nearly doubled since.

How much has been stolen?

Coinspect puts at least $5.7 million drained across two sweeps that began in late May, and stresses that figure is a floor. The thefts have been tracked on-chain, meaning directly from the public blockchain ledger, under the name "Ill Bloom." On-chain analysis only catches wallets researchers can tie together, and quiet one-off drains often slip past the first pass, so the total will likely climb.

Which wallets are affected?

Five cryptocurrency wallet applications built recovery phrases using the weak CryptoJS function, according to Coinspect's analysis first reported by The Hacker News. The specific apps have been flagged to their developers. Check for urgent notices from any wallet you use before moving funds.

If your wallet is on the list, the safe assumption is brutal but simple: the recovery phrase you were given isn't secret anymore. Anyone who can reproduce the flawed randomness can reproduce your phrase.

What should wallet users do now?

Generate a brand new wallet using software you trust and move your funds to it. Don't import the old recovery phrase into a new app: that carries the weakness with it. Treat the old wallet as burned.

A quick checklist:

• Watch for an official advisory from your wallet provider and follow their migration steps.
• Create a new wallet in an app that uses a strong system random source, then transfer coins to the new address.
• Retire the old recovery phrase and never reuse it.
• Check transaction history for withdrawals you didn't make and report them to the wallet vendor.

Was this an authentication failure?

Not in the usual sense. This isn't a stolen password or a bypassed login, so multi-factor authentication, the second verification step like a code from your phone, wouldn't have helped. In crypto, whoever knows the recovery phrase is the owner. The flaw let attackers derive the phrase itself, which is closer to guessing the master key than picking a lock.

That's why the fix has to happen at the wallet level, not in the user's habits. No amount of careful clicking protects a secret that was weak the moment it was created. Worth watching: whether any of the five affected apps patch their key-generation path or simply advise migration, because those are very different commitments to users whose next wallet might inherit the same library.

Common questions

Is CryptoJS itself unsafe to use?

Most of the library's functions are fine for general use. The specific problem is calling WordArray.random() for high-value secrets like wallet seeds. Developers should use the platform's built-in secure random source instead.

How can I tell if my recovery phrase came from a weak generator?

You usually can't tell by looking at it. Rely on your wallet vendor's advisory, and if in doubt, migrate to a freshly generated wallet from a reputable app.