Weak CryptoJS RNG Led to $5.7 Million in Crypto Wallet Drains Across Five Apps

Vulnerability Identified in CryptoJS Library

Blockchain security firm Coinspect has identified the CryptoJS.lib.WordArray.random() function as the source of a weak random number generator (RNG) that led to significant cryptocurrency theft. This function, part of the JavaScript cryptography library for 12 years, provided insufficient entropy for generating recovery phrases in several wallet applications.

Financial Impact and Affected Applications

Coinspect's on-chain analysis indicates that approximately $5.7 million was stolen in two separate sweeps since late May due to this vulnerability. Five specific wallet applications were confirmed to have used the compromised generator for recovery phrase generation: RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo. Some of these applications have since been discontinued or updated to fix the issue, though updating does not repair existing compromised phrases.

Technical Details of the Weakness

The vulnerability significantly reduced the cryptographic strength of recovery phrases. While 128-bit and 256-bit entropy should yield search spaces of 2^128 and 2^256 respectively, the weak generator reduced these to roughly 2^39 and 2^47. These reduced search spaces are small enough to be enumerated using ordinary hardware, allowing attackers to guess recovery phrases and access funds.

User Action Required

Users who generated recovery phrases with any of the affected wallet versions must create a new, securely generated phrase and transfer their funds to it. A compromised phrase remains vulnerable even if imported into a hardware wallet. Coinspect advises that hardware-generated seeds and most current software wallets are not affected by this specific issue.