For twelve years, a function designed to generate randomness delivered predictable numbers to cryptocurrency wallets instead – and now researchers have quantified precisely how much that cost users. Coinspect has discovered that the CryptoJS.lib.WordArray.random() function produced insufficient entropy when generating seed phrases for crypto wallets. The incident has been named Ill Bloom.
Five Affected Wallets, Uneven Remediation
The weakness affected five wallet applications. As documented in Coinspect’s Ill Bloom investigation, RRWallet and Milo have been discontinued and will receive no patches. Bexo Wallet and NanChat have released updated versions. Bitcoin Libre resolved the issue independently back in 2024.
Crucially, updating an application does not retroactively secure seed phrases that were already generated under the vulnerable version. Those phrases must be replaced manually by the wallet owner.
How the Entropy Collapsed
The flaw dramatically compressed the effective keyspace available to attackers attempting a brute-force search. For wallets targeting 128-bit entropy, the exploitable search space shrank from the intended 2^128 possibilities down to approximately 2^39. For 256-bit entropy targets, the collapse was even more pronounced – from 2^256 down to just 2^47.
Both figures fall well within the range achievable on commodity hardware. This made it feasible for adversaries to reconstruct seed phrases and gain unauthorized access to the corresponding wallets without any specialized resources.
Two Theft Cycles: $5.69 Million Total
Coinspect documented two distinct waves of exploitation. The first, on May 27 of this year, resulted in approximately $3.14 million drained from 431 wallets in a single operation. The second wave, running from May 30 through July 13, extracted a further $2.55 million – including a transfer of 2.18 million USDT from a single account on the Tron network – linked to 522 compromised seed phrases.
In total, Coinspect identified 2,114 compromised seed phrases and estimates the confirmed losses at a minimum of $5.69 million.
A Twelve-Year Timeline
The vulnerability’s origins trace back to 2014, when CryptoJS introduced a Multiply-With-Carry random number generator seeded through JavaScript’s Math.random() – a function explicitly unsuitable for cryptographic purposes.
Versions 3.2.0 and 3.2.1 temporarily corrected the flaw by switching to a cryptographically secure random source. However, in version 3.3.0, developers reverted to the original implementation, judging the change too disruptive to backward compatibility. The defect was not definitively resolved until version 4.0.0, released in February 2020.
The Advisory: CVSS 9.0
On August 5, project maintainer Evan Vosberg published a formal security advisory for GHSA-rg76-677x-56q9 assigning a critical severity rating of 9.0 on the CVSS scale. The advisory is clear on scope: only applications that specifically used this function to generate key material are at risk. The mere presence of the CryptoJS library in a project does not constitute a vulnerability in isolation.
Further technical analysis of the flaw and its exploitation patterns is available in the Ill Bloom detailed vulnerability write-up.
What Affected Users Must Do
Owners of wallets generated by any application that relied on a vulnerable version of CryptoJS below 4.0.0 should treat their existing seed phrases as irreversibly compromised. This applies even if those phrases were subsequently imported into a different application – including a hardware wallet – because the weakness is inherent to the phrase itself, not the device storing it.
The only reliable remediation is to generate an entirely new seed phrase using a current, patched version of the application, then transfer all funds to addresses derived from the new phrase. No amount of updating software or changing storage medium can rehabilitate a seed phrase produced with insufficient entropy.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
