A 12-year-old flaw in a popular crypto library drained $5.7 million from wallets

Key points

• Coinspect blamed the wallet thefts on CryptoJS.lib.WordArray.random(), a random number generator built into the popular CryptoJS JavaScript library.
• The weak function has sat inside the library for roughly 12 years and produced predictable output when used to seed recovery phrases.
• Five cryptocurrency wallet apps relied on it, exposing users grouped under the "Ill Bloom" thefts.
• Coinspect measured at least $5.7 million stolen across two sweeps since late May 2024, and calls that a lower bound.
• Users of affected wallets should assume their recovery phrases are exposed and move funds to a freshly generated wallet.

Security researchers at Coinspect say they have found the reason a string of cryptocurrency wallets kept getting emptied out. The culprit is a small piece of code, buried inside a library that thousands of developers trust, that was never as random as it looked.

The faulty piece is a function called CryptoJS.lib.WordArray.random(). It lives inside CryptoJS, a widely used JavaScript toolkit for cryptography, meaning code that scrambles and protects data. Wallet apps called this function to generate the secret "recovery phrase" that controls a user's coins.

Here is the problem. That function, added to the library about 12 years ago, produces numbers that are not truly unpredictable. In cryptography, "weak entropy" means the randomness has patterns an attacker can guess. Guess the randomness, and you can guess the recovery phrase. Guess the recovery phrase, and the wallet is yours.

How much has been stolen?

Coinspect measured at least $5.7 million drained across two sweeps that began in late May, and stresses that figure is a floor, not a ceiling. The thefts have been tracked on-chain, meaning directly from the public blockchain ledger, under the name "Ill Bloom."

More money may already be gone. On-chain analysis only catches wallets the researchers can tie together, and quiet, one-off drains often slip past the first pass. Expect the total to climb as more affected wallets are identified.

Which wallets are affected?

Five cryptocurrency wallet applications built recovery phrases using the weak CryptoJS function, according to Coinspect's analysis first reported by The Hacker News. The specific apps have been flagged to their developers, and users should check for urgent notices from any wallet they use before moving funds.

If your wallet is on the list, the safe assumption is brutal but simple: the recovery phrase you were given is not secret anymore. Anyone who can reproduce the flawed randomness can reproduce your phrase.

What should wallet users do now?

Generate a brand new wallet using software you trust, and move your funds to it. Do not import the old recovery phrase into a new app: that carries the weakness with it. Treat the old wallet as burned.

A quick checklist:

• Watch for an official advisory from your wallet provider and follow their migration steps.
• Create a new wallet in an app that uses a strong system random source, then transfer coins to the new address.
• Retire the old recovery phrase. Never reuse it.
• Check transaction history for withdrawals you did not make, and report them to the wallet vendor.

Was this an authentication failure?

Not in the usual sense. This is not a case of a stolen password or a bypassed login, so multi-factor authentication, the second step like a code from your phone, would not have helped. In crypto, whoever knows the recovery phrase is the owner. The flaw let attackers work out the phrase itself, which is closer to guessing the master key than picking a lock.

That is why the fix has to happen at the wallet level, not the user's habits. No amount of careful clicking protects a secret that was weak the moment it was created.

Common questions

Is CryptoJS itself unsafe to use?

The library has many functions and most are fine for general use. The specific issue is calling WordArray.random() for high-value secrets like wallet seeds. Developers should use the platform's built-in secure random source instead.

How can I tell if my recovery phrase came from a weak generator?

You usually cannot tell by looking at it. Rely on your wallet vendor's advisory, and if in doubt, migrate to a freshly generated wallet from a reputable app.