A critical vulnerability in the CryptoJS JavaScript library has been exploited, resulting in the theft of approximately $5.7 million from cryptocurrency wallets. The flaw resides in the CryptoJS.lib.WordArray.random() function, which has been generating weak random numbers since its introduction 12 years ago. This function’s inadequate entropy compromised the security of recovery phrases used by several wallet applications.
Impacted Wallet Applications
Coinspect, a blockchain security firm, has identified five wallet applications affected by this vulnerability:
- RRWallet: Discontinued; no fix available.
- Bexo Wallet: Issue addressed in version 20.1.0; updated builds pending upload.
- NanChat: Versions prior to 1.3.0 were vulnerable; fixed in version 1.3.0.
- Bitcoin Libre: Vulnerability resolved in version 4, released in July 2024.
- Milo: Discontinued; no fix available.
Users of these wallets are advised to generate new, secure recovery phrases and transfer their funds accordingly, as updating the application alone does not mitigate the risk associated with previously generated phrases.
Technical Details and Historical Context
The CryptoJS.lib.WordArray.random() function’s weak random number generation significantly reduced the entropy of recovery phrases. For instance, 128-bit and 256-bit entropy, which should provide search spaces of 2128 and 2256 respectively, were diminished to approximately 239 and 247. Such reduced entropy levels are susceptible to enumeration attacks using standard hardware.
Initially, in June 2014, the library introduced a Multiply-With-Carry generator seeded from Math.random(). Subsequent releases (3.2.0 and 3.2.1) switched to native cryptographic randomness. However, version 3.3.0 reverted to the weaker generator due to compatibility concerns. It wasn’t until February 2020, with the release of version 4.0.0, that native randomness was permanently reinstated.
One identified vector for this vulnerability was the ferrumnet/bip39 React Native fork, which replaced the upstream bip39‘s native cryptographic randomness with CryptoJS. This substitution inadvertently introduced the weak random number generation into wallet software.
Security Advisory and Recommendations
On August 5, 2026, CryptoJS maintainer Evan Vosberg issued a security advisory (GHSA-rg76-677x-56q9) with a Critical rating and a CVSS score of 9.0. The advisory indicates that all releases below version 4.0.0 are affected, except for versions 3.2.0 and 3.2.1, which had temporarily addressed the issue.
It’s important to note that applications are only vulnerable if they utilize the compromised function to generate security-sensitive values. Merely including the affected dependency does not inherently pose a risk. Developers are urged to audit their codebases to ensure that secure random number generation practices are in place.
This incident underscores the critical importance of robust random number generation in cryptographic applications. Developers must remain vigilant, ensuring that libraries and dependencies are up-to-date and that their implementations adhere to best security practices. Users should also be proactive in updating their software and regenerating security credentials when vulnerabilities are disclosed.
