#10
The Hacker News
general
August 06, 2026 at 11:49 UTC
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps
By [email protected] (The Hacker News)
AI Summary
Coinspect identified the 12-year-old CryptoJS.lib.WordArray.random() function as the weak RNG responsible for the 'Ill Bloom' wallet drains, which affected five cryptocurrency wallet applications that used it to generate recovery phrases. On-chain analysis measured confirmed theft of at least $5.7 million across two sweeps since late May 2026, making this a critical warning for any wallet or cryptographic application still depending on CryptoJS for entropy generation.
Relevance score: 80.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →