{"investigation":{"slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","entity_name":"CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)","trust_score":3,"severity_base":null,"score_modifier":-1.4,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Ill Bloom (CVE-2026-71851, CVSS 9.0) is an actively exploited weakness in the crypto-js library, versions 3.1.2-4 through 3.3.x, whose CryptoJS.lib.WordArray.random() used a Math.random()-seeded generator, shrinking the effective keyspace of wallet recovery phrases to roughly 2^39 and letting attackers enumerate and drain them offline across every chain derived from a seed. Coinspect, which disclosed it in stages in July and August 2026, measured at least $5.69 million drained from at least 2,114 vulnerable addresses, a figure it calls a lower bound, and named five affected wallet applications: RRWallet, Milo, Bexo Wallet, NanChat and Bitcoin Libre. Because the weakness lies in seed phrases already generated, affected users must move funds to a newly generated wallet; hardware wallets and most mainstream software wallets are reported unaffected.","sections":[{"content":"Ill Bloom is the name Coinspect gave to a cryptographic weakness in which certain cryptocurrency wallet applications generated BIP-39 recovery phrases with far less entropy than intended, letting attackers enumerate and drain the resulting wallets. The name is wordplay on the first recovery phrase the vulnerable generator produces, which begins with the words 'illness blossom'. Coinspect first disclosed the vulnerability class publicly on or around July 6, 2026, without naming the affected software. Its full disclosure in August 2026 traced the root cause to the crypto-js npm library, tracked as CVE-2026-71851 (GitHub Advisory GHSA-rg76-677x-56q9). In crypto-js versions 3.1.2-4 through 3.3.x, the function CryptoJS.lib.WordArray.random(), which developers relied on to generate cryptographic keys, initialization vectors and BIP-39 mnemonic seed phrases, used a custom Multiply-With-Carry (MWC) pseudorandom number generator seeded by JavaScript's non-cryptographic Math.random(). The National Vulnerability Database and CVEReports assigned a CVSS v3.1 base score of 9.0 (Critical), vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The flaw was introduced on June 19, 2014. Versions 3.2.0 and 3.2.1 briefly corrected it by using native cryptographic randomness, but version 3.3.0 reverted the fix, describing the secure change as 'breaking'. A robust fix shipped in version 4.0.0 around May 1, 2020, six years before active exploitation was documented. The library has been effectively unmaintained since 2023.","heading":"Vulnerability Overview","sources":[{"url":"https://cvereports.com/reports/CVE-2026-71851","name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","credibility":2},{"url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","credibility":2},{"url":"https://www.coinspect.com/blog/ill-bloom-investigation/","name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","credibility":2},{"url":"https://github.com/brix/crypto-js/issues/536","name":"ALERT/WARNING: All users of crypto-js must replace by crypto-es | GitHub Issue #536","type":"official","credibility":2},{"url":"https://illbloom.org/","name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","credibility":1},{"url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html","name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","credibility":1},{"url":"https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/","name":"Coinspect warns Ill Bloom flaw may drain more crypto wallets — Crypto.news","type":"news_article","credibility":2}],"severity":"critical"},{"content":"A wallet must seed BIP-39 mnemonic generation with a cryptographically secure random number. In affected crypto-js versions, the MWC generator is initialised with Math.random() * 0x100000000, casting JavaScript's floating-point Math.random() output to a 32-bit integer seed. Math.random() is specified as non-cryptographic and may be seeded deterministically from process or time state, yielding at most 48 bits of effective state and commonly far less. With additional sign-choice entropy from word generation, a nominally 128-bit key space collapses to an effective space of approximately 2^39, and a nominally 256-bit key space to approximately 2^47. Coinspect's initial July disclosure, before the crypto-js attribution, described the affected applications more generally as using a standard non-cryptographic PRNG or one seeded with insufficiently unpredictable state, such as system time or device identifiers. Because the entropy is constrained at generation time, no downstream processing, including BIP-39 PBKDF2 derivation, can restore it. The attack is passive and offline and needs no access to the victim's device, network or account: an attacker enumerates every output the weak generator can produce, converts each to a BIP-39 mnemonic, derives the corresponding addresses and checks public blockchain records for funded accounts. Coinspect reconstructed this methodology end-to-end, and researchers noted that ordinary home computers can complete such an enumeration in a realistic timeframe. Because BIP-44 derivation paths for every chain come from the same root seed, a weak seed exposes the holder's addresses on all chains at once. In at least one confirmed case the flaw reached wallet software through ferrumnet/bip39, a React Native fork of the standard bip39 library that replaced the upstream library's native cryptographic randomness with CryptoJS's insecure function.","heading":"Technical Root Cause: Entropy Collapse","sources":[{"url":"https://cvereports.com/reports/CVE-2026-71851","name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","credibility":2},{"url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","credibility":2},{"url":"https://www.coinspect.com/blog/ill-bloom-investigation/","name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","credibility":2},{"url":"https://illbloom.org/","name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","credibility":1},{"url":"https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/","name":"Coinspect warns Ill Bloom flaw may drain more crypto wallets — Crypto.news","type":"news_article","credibility":2},{"url":"https://forklog.com/en/coinspect-warns-of-vulnerability-threatening-thousands-of-crypto-wallets/","name":"Coinspect Warns of Vulnerability Threatening Thousands of Crypto Wallets — ForkLog","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Coinspect identified five vulnerable wallet implementations. It withheld their names at the July 2026 disclosure, citing a staged disclosure intended to avoid giving attackers further guidance while users migrated funds, and named them in August 2026 as applications that used CryptoJS.lib.WordArray.random() as the entropy source for recovery phrases: RRWallet: discontinued; no patch possible, so users can only migrate funds away from seed phrases generated with affected versions. Milo: discontinued; no patch possible; the same constraint applies. Bexo Wallet: patch released in version 20.1.0, but as of the August 2026 disclosure updated builds had not yet been uploaded to distribution channels, so users may be running unpatched versions. NanChat: versions before 1.3.0 independently confirmed affected; fixed in 1.3.0. Bitcoin Libre: fixed in version 4 (released July 2024, before the exploitation campaign); users on version 4 or later are not exposed. Hardware wallets such as Ledger and Trezor are not affected, because they generate seed phrases with dedicated secure elements and hardware random number sources rather than software PRNGs, and most mainstream software wallets are also reported unaffected. The population at risk is concentrated among users who generated seeds with lesser-known or older mobile software wallets, potentially including browser extensions. Wallets generated as early as 2018 have been identified as vulnerable, and reports noted that new vulnerable wallets were still being created close to the disclosure in 2026. Users who received a wallet from a third party, used a wallet application with no documented security audit, or are unsure which software generated their seed are advised to treat it as potentially compromised.","heading":"Affected Wallet Applications","sources":[{"url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","credibility":2},{"url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/","name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","credibility":2},{"url":"https://illbloom.org/","name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","credibility":1},{"url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html","name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","credibility":1},{"url":"https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/","name":"Coinspect warns Ill Bloom flaw may drain more crypto wallets — Crypto.news","type":"news_article","credibility":2}],"severity":"critical"},{"content":"A vulnerable seed phrase exposes funds on every chain whose keys derive from it. Coinspect's analysed dataset, with a snapshot date of June 30, 2026, contained 2,114 funded addresses with on-chain activity from September 2018 to May 2026. Reports differ on which chains it covered: Bitcoin, Ethereum, Tron, Rootstock and Polygon according to the August reporting and The Hacker News, with Solana also listed in other accounts of the July disclosure. The illbloom.org disclosure site lists a broader set of chains, including BNB Chain, Arbitrum, Optimism, Base, Avalanche, Gnosis, Linea, HyperEVM and Monad, indicating that its address checker covers derivation paths for those networks even though they were not the main chains in the initial loss tally.","heading":"Affected Chains and Scope","sources":[{"url":"https://illbloom.org/","name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","credibility":1},{"url":"https://www.tradingview.com/news/cointelegraph:e1ab8d173094b:0-thousands-of-crypto-wallets-at-risk-from-ill-bloom-vulnerability-coinspect/","name":"Thousands of crypto wallets at risk from 'Ill Bloom' vulnerability: Coinspect | TradingView / Cointelegraph","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html","name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","credibility":1},{"url":"https://forklog.com/en/coinspect-warns-of-vulnerability-threatening-thousands-of-crypto-wallets/","name":"Coinspect Warns of Vulnerability Threatening Thousands of Crypto Wallets — ForkLog","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","credibility":2}],"severity":"high"},{"content":"Coinspect identified the vulnerability while investigating a wallet-drain incident that began in May 2026. Active exploitation began on May 27, 2026, with a coordinated sweep that drained 431 wallet addresses in a single day for approximately $3.14 million ($3,140,968). By chain, as reported by ForkLog and Coinspect: Bitcoin approximately $2.57 million (including one address that lost over $1.1 million), Ethereum $285,778, Rootstock $177,225, Tron $80,970 and Polygon $23,473. A second wave ran from approximately May 30 through July 13, 2026, draining approximately $2.55 million from 522 additional seeds. On June 10, Coinspect identified additional exposed funds but could not alert the owner in time to prevent a drain. Reports differ on the largest second-wave drain: a single Tron account lost approximately $2.18 million in USDT on or around July 4, 2026, according to The Hacker News, while CoinGeek and ForkLog report approximately $2.1 million in USDT drained from a separately identified exposed wallet, dated July 5. Drains targeting Chinese-mnemonic wallets were documented on July 20 and 21, 2026. At the July disclosure Coinspect put confirmed losses at more than $5 million; by the August disclosure it reported at least 2,114 vulnerable addresses and measured losses of approximately $5.69 million, which it described as a lower bound. The identified addresses reached a historical peak value of $12.56 million in 2022. Accounts interpret that figure differently: the August reporting presents it as a sign that true potential exposure was substantially higher, while the July reporting says it indicates some funds were moved or spent by legitimate holders before attackers acted. Coinspect cautioned that its dataset is a partial sample and that the real number of vulnerable addresses and total losses may be significantly higher.","heading":"Exploitation Campaign and Measured Losses","sources":[{"url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html","name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","credibility":1},{"url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","credibility":2},{"url":"https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/","name":"'Ill Bloom' flaw puts 2,114 digital wallets at risk: report | CoinGeek","type":"news_article","credibility":2},{"url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/","name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","credibility":2},{"url":"https://en.cryptonomist.ch/2026/07/06/ill-bloom-vulnerability-crypto-wallets/","name":"Ill Bloom Vulnerability Drains $5 Million from Crypto Wallets | Cryptonomist","type":"news_article","credibility":2},{"url":"https://forklog.com/en/coinspect-warns-of-vulnerability-threatening-thousands-of-crypto-wallets/","name":"Coinspect Warns of Vulnerability Threatening Thousands of Crypto Wallets — ForkLog","type":"news_article","credibility":2},{"url":"https://beincrypto.com/ill-bloom-vulnerability-crypto-wallets/","name":"Ill Bloom Vulnerability Drains $3.1 Million From Crypto Wallets: Are You Exposed? — BeInCrypto","type":"news_article","credibility":2},{"url":"https://illbloom.org/","name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","credibility":1}],"severity":"critical"},{"content":"As of the July 2026 disclosure, thousands of vulnerable addresses had not yet been swept, and funds in them could be drained at any time. Attackers have shown they can run coordinated mass sweeps across several blockchains at once, as on May 27, 2026. Because the weakness lies in seed phrases already generated, it cannot be patched retroactively: any wallet whose recovery phrase came from an affected crypto-js version remains permanently at risk regardless of later software updates. Users with funds in potentially affected wallets are advised to treat the situation as an emergency and migrate immediately.","heading":"Ongoing Risk","sources":[{"url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html","name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","credibility":1},{"url":"https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/","name":"Coinspect warns Ill Bloom flaw may drain more crypto wallets — Crypto.news","type":"news_article","credibility":2},{"url":"https://illbloom.org/","name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","credibility":1},{"url":"https://cvereports.com/reports/CVE-2026-71851","name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","credibility":2},{"url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Coinspect and independent researchers agree that updating the wallet application is not enough. The only effective remediation is to create a new wallet with trusted, security-audited software that generates entropy securely, generate a new recovery phrase in it, and move all funds to addresses derived from that new seed. Re-importing the compromised phrase into a different application offers no protection, because the phrase itself is the compromised element. RRWallet and Milo users have no supported migration path and must import their phrases into a compatible third-party wallet and then migrate. Bexo Wallet users must confirm they have the patched 20.1.0 build; NanChat users should update to 1.3.0 or later; Bitcoin Libre users on version 4 or later are not exposed. Users who are unsure are advised to move to hardware wallets or wallets with documented security evaluations. Coinspect's free checker at illbloom.org lets users check public wallet addresses against the known vulnerable dataset. Users should enter only a public address, never a seed phrase or private key; Coinspect said it will never ask for seed phrases, private keys, transaction signatures or approvals. A negative result does not guarantee safety, since further analysis of other chains or wallet implementations may reveal more vulnerable addresses. For developers, the recommended fix is to upgrade to crypto-js 4.0.0 or later, or to override CryptoJS.lib.WordArray.random with window.crypto.getRandomValues() in browsers or crypto.randomBytes() in Node.js. All secrets generated with affected versions must be treated as permanently compromised and regenerated.","heading":"Remediation and User Guidance","sources":[{"url":"https://cvereports.com/reports/CVE-2026-71851","name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","credibility":2},{"url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","credibility":2},{"url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/","name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","credibility":2},{"url":"https://illbloom.org/","name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","credibility":1},{"url":"https://x.com/coinspect/status/2073935687770890458","name":"Coinspect Security on X — public disclosure announcement","type":"social_media","credibility":3},{"url":"https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/","name":"'Ill Bloom' flaw puts 2,114 digital wallets at risk: report | CoinGeek","type":"news_article","credibility":2}],"severity":"high"},{"content":"Coinspect, a blockchain and smart contract security firm with more than twelve years of operating history, ran a staged disclosure. Around July 6 to 10, 2026, it disclosed the vulnerability class, announced it via its official X account and published the affected-address dataset and free checker at illbloom.org, withholding wallet names and exploit details to limit risk to users with funds still in vulnerable accounts. It said it had coordinated with affected wallet developers and with the security firm SlowMist, which was reported to be monitoring the threat. On August 5, 2026, Coinspect published full technical attribution on its blog, linking the flaw to crypto-js and naming the five wallet applications; GitHub Advisory GHSA-rg76-677x-56q9 and CVE-2026-71851 were formally published between August 5 and 7, 2026. At the time of the July disclosure, no independent verification of Coinspect's figures on vulnerable wallets or the completeness of its dataset was available, although the on-chain transactions it cited, such as the May 27, 2026 sweep of 431 addresses, can be checked on public blockchains. Multiple media outlets reported the disclosure without raising concerns about the credibility of Coinspect's findings.","heading":"Disclosure Timeline and Researcher Attribution","sources":[{"url":"https://www.coinspect.com/blog/ill-bloom-investigation/","name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","credibility":2},{"url":"https://illbloom.org/","name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","credibility":1},{"url":"https://www.tradingview.com/news/cointelegraph:e1ab8d173094b:0-thousands-of-crypto-wallets-at-risk-from-ill-bloom-vulnerability-coinspect/","name":"Thousands of crypto wallets at risk from 'Ill Bloom' vulnerability: Coinspect | TradingView / Cointelegraph","type":"news_article","credibility":2},{"url":"https://x.com/coinspect/status/2073935687770890458","name":"Coinspect Security on X — public disclosure announcement","type":"social_media","credibility":3},{"url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html","name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","credibility":1},{"url":"https://forklog.com/en/coinspect-warns-of-vulnerability-threatening-thousands-of-crypto-wallets/","name":"Coinspect Warns of Vulnerability Threatening Thousands of Crypto Wallets — ForkLog","type":"news_article","credibility":2}],"severity":"medium"},{"content":"CryptoJS was embedded across hundreds of JavaScript and npm packages, and many wallet developers integrated it without knowing about the PRNG weakness. The flaw's twelve-year lifespan (introduced 2014, actively exploited 2026) and the library's unmaintained status since 2023 illustrate systemic supply-chain risk in cryptocurrency wallet development. Ill Bloom is structurally similar to Randstorm, disclosed by Unciphered in November 2023, which documented comparable weak-randomness problems in Bitcoin wallets generated with BitcoinJS between 2011 and 2015; as with Randstorm, the exposure cannot be patched retroactively for wallets generated during the affected period. CertiK and others have flagged Math.random()-dependent cryptographic code as a recurring risk in the JavaScript ecosystem.","heading":"Broader Context: Supply Chain and Ecosystem Risk","sources":[{"url":"https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/","name":"Randstorm: You Can't Patch a House of Cards | Unciphered","type":"research","credibility":2},{"url":"https://www.techtarget.com/searchsecurity/news/366559456/Cryptocurrency-wallets-might-be-vulnerable-to-Randstorm-flaw","name":"Cryptocurrency wallets might be vulnerable to 'Randstorm' flaw | TechTarget","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","credibility":2},{"url":"https://www.coinspect.com/blog/ill-bloom-investigation/","name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","credibility":2}],"severity":"high"}],"timeline":[{"date":"2014-06","event":"On June 19, 2014, the vulnerable Multiply-With-Carry PRNG seeded by Math.random() was introduced into the crypto-js codebase.","source":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2018-09","event":"Earliest known on-chain activity from wallets later identified as vulnerable; affected wallet applications were generating insecure seed phrases.","source":"Coinspect Warns of Vulnerability Threatening Thousands of Crypto Wallets — ForkLog","source_url":"https://forklog.com/en/coinspect-warns-of-vulnerability-threatening-thousands-of-crypto-wallets/"},{"date":"2020-02","event":"A flawed wrapper patch was committed to crypto-js; it did not fully resolve the entropy issue.","source":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2020-05","event":"crypto-js version 4.0.0 released, restoring native cryptographic randomness and resolving the vulnerability for new users.","source":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2022","event":"Historical peak value of the identified exposed addresses reached approximately $12.56 million, per Coinspect's on-chain analysis.","source":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","source_url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"date":"2023","event":"crypto-js became effectively unmaintained; versions before 4.0.0 remained in use across downstream npm packages.","source":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2026-05","event":"Coinspect identified active wallet-drain exploitation linked to the weak PRNG and began its investigation.","source":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2026-05","event":"On May 27, 2026, a coordinated sweep drained 431 vulnerable wallet addresses across Bitcoin, Ethereum, Rootstock, Tron and Polygon in one day for approximately $3.14 million ($3,140,968), of which Bitcoin accounted for about $2.57 million.","source":"Coinspect Warns of Vulnerability Threatening Thousands of Crypto Wallets — ForkLog","source_url":"https://forklog.com/en/coinspect-warns-of-vulnerability-threatening-thousands-of-crypto-wallets/"},{"date":"2026-05","event":"A second exploitation wave began around May 30, 2026, continuing through July 13 and draining approximately $2.55 million from 522 additional seeds.","source":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2026-06","event":"On June 10, 2026, Coinspect identified additional exposed funds but could not alert the wallet owner in time to prevent a drain.","source":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","source_url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"date":"2026-06","event":"June 30, 2026 was the snapshot date of Coinspect's analysed dataset of 2,114 funded vulnerable addresses.","source":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","source_url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"date":"2026-07","event":"On or around July 4, 2026, a single Tron-based account lost approximately $2.18 million in USDT during the second sweep (The Hacker News; CoinGeek reports about $2.1 million, dated July 5).","source":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2026-07","event":"Approximately $2.1 million in USDT was drained from a separately identified vulnerable address, dated July 5, 2026 in this account.","source":"'Ill Bloom' flaw puts 2,114 digital wallets at risk: report | CoinGeek","source_url":"https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/"},{"date":"2026-07","event":"Around July 6, 2026, Coinspect published its initial partial disclosure of Ill Bloom and the illbloom.org address checker, without naming affected wallets; confirmed losses then exceeded $5 million, and SlowMist was reported to be monitoring.","source":"Ill Bloom Vulnerability Drains $5 Million from Crypto Wallets | Cryptonomist","source_url":"https://en.cryptonomist.ch/2026/07/06/ill-bloom-vulnerability-crypto-wallets/"},{"date":"2026-07","event":"On July 13, 2026, the second exploitation sweep ended, per Coinspect's on-chain analysis.","source":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2026-07","event":"On July 20 and 21, 2026, drains targeting Chinese-mnemonic wallets were documented.","source":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","source_url":"https://illbloom.org/"},{"date":"2026-08","event":"On August 5, 2026, Coinspect published its full technical disclosure, naming the five affected wallet applications and tracing the root cause to crypto-js; GitHub Advisory GHSA-rg76-677x-56q9 and CVE-2026-71851 were published between August 5 and 7.","source":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"}],"sources_used":[{"url":"https://cvereports.com/reports/CVE-2026-71851","name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","archive_url":"https://web.archive.org/web/20260808063028/https://cvereports.com/reports/CVE-2026-71851","credibility":2,"archive_timestamp":"2026-08-08T06:30:28+00:00"},{"url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260807040320/https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html","credibility":2,"archive_timestamp":"2026-08-07T04:03:20+00:00"},{"url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html","name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260805222359/https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html","credibility":1,"archive_timestamp":"2026-08-05T22:23:59+00:00"},{"url":"https://www.coinspect.com/blog/ill-bloom-investigation/","name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","archive_url":"http://web.archive.org/web/20260806032840/https://www.coinspect.com/blog/ill-bloom-investigation","credibility":2,"archive_timestamp":"2026-08-06T03:28:40+00:00"},{"url":"https://illbloom.org/","name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","archive_url":"http://web.archive.org/web/20260720223130/https://illbloom.org/","credibility":1,"archive_timestamp":"2026-07-20T22:31:30+00:00"},{"url":"https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/","name":"'Ill Bloom' flaw puts 2,114 digital wallets at risk: report | CoinGeek","type":"news_article","archive_url":"https://web.archive.org/web/20260807231852/https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/","credibility":2,"archive_timestamp":"2026-08-07T23:18:52+00:00"},{"url":"https://en.cryptonomist.ch/2026/07/06/ill-bloom-vulnerability-crypto-wallets/","name":"Ill Bloom Vulnerability Drains $5 Million from Crypto Wallets | Cryptonomist","type":"news_article","archive_url":"http://web.archive.org/web/20260728042319/https://en.cryptonomist.ch/2026/07/06/ill-bloom-vulnerability-crypto-wallets/","credibility":2,"archive_timestamp":"2026-07-28T04:23:19+00:00"},{"url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/","name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","archive_url":"https://web.archive.org/web/20260808040224/https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/","credibility":2,"archive_timestamp":"2026-08-08T04:02:24+00:00"},{"url":"https://www.techtimes.com/articles/319796/20260706/crypto-wallets-lose-5m-broken-random-number-generator-ill-bloom-disclosure.htm","name":"Crypto Wallets Lose $5M to Broken Random Number Generator: Ill Bloom Disclosure | TechTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260724161353/https://www.techtimes.com/articles/319796/20260706/crypto-wallets-lose-5m-broken-random-number-generator-ill-bloom-disclosure.htm","credibility":2,"archive_timestamp":"2026-07-24T16:13:53+00:00"},{"url":"https://cryptobriefing.com/crypto-wallets-at-risk-from-ill-bloom-vulnerability-5m-stolen/","name":"Crypto wallets at risk from 'Ill Bloom' vulnerability, $5M stolen | Crypto Briefing","type":"news_article","archive_url":"https://web.archive.org/web/20260807231918/https://cryptobriefing.com/crypto-wallets-at-risk-from-ill-bloom-vulnerability-5m-stolen/","credibility":2,"archive_timestamp":"2026-08-07T23:19:18+00:00"},{"url":"https://www.tradingview.com/news/cointelegraph:e1ab8d173094b:0-thousands-of-crypto-wallets-at-risk-from-ill-bloom-vulnerability-coinspect/","name":"Thousands of crypto wallets at risk from 'Ill Bloom' vulnerability: Coinspect | TradingView / Cointelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260727143403/https://www.tradingview.com/news/cointelegraph:e1ab8d173094b:0-thousands-of-crypto-wallets-at-risk-from-ill-bloom-vulnerability-coinspect/","credibility":2,"archive_timestamp":"2026-07-27T14:34:03+00:00"},{"url":"https://phemex.com/news/article/ill-bloom-wallet-vulnerability-threatens-thousands-of-crypto-accounts-91917","name":"'Ill Bloom' Vulnerability Endangers Crypto Wallets | Phemex News","type":"news_article","archive_url":"https://web.archive.org/web/20260808040400/https://phemex.com/news/article/ill-bloom-wallet-vulnerability-threatens-thousands-of-crypto-accounts-91917","credibility":2,"archive_timestamp":"2026-08-08T04:04:00+00:00"},{"url":"https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/","name":"Randstorm: You Can't Patch a House of Cards | Unciphered","type":"research","archive_url":"http://web.archive.org/web/20260604190532/https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/","credibility":2,"archive_timestamp":"2026-06-04T19:05:32+00:00"},{"url":"https://www.techtarget.com/searchsecurity/news/366559456/Cryptocurrency-wallets-might-be-vulnerable-to-Randstorm-flaw","name":"Cryptocurrency wallets might be vulnerable to 'Randstorm' flaw | TechTarget","type":"news_article","archive_url":"http://web.archive.org/web/20260116225514/https://www.techtarget.com/searchsecurity/news/366559456/Cryptocurrency-wallets-might-be-vulnerable-to-Randstorm-flaw","credibility":2,"archive_timestamp":"2026-01-16T22:55:14+00:00"},{"url":"https://github.com/brix/crypto-js/issues/536","name":"ALERT/WARNING: All users of crypto-js must replace by crypto-es | GitHub Issue #536","type":"official","archive_url":"http://web.archive.org/web/20260806032818/https://github.com/brix/crypto-js/issues/536","credibility":2,"archive_timestamp":"2026-08-06T03:28:18+00:00"},{"url":"https://medium.com/coinmonks/july-2026-crypto-hacks-242m-lost-as-a-hardware-wallet-bug-outweighed-every-defi-exploit-56ef16f82dc5","name":"July 2026 Crypto Hacks: $242M+ Lost | CoinMonks / Medium","type":"news_article","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://forklog.com/en/coinspect-warns-of-vulnerability-threatening-thousands-of-crypto-wallets/","name":"Coinspect Warns of Vulnerability Threatening Thousands of Crypto Wallets — ForkLog","type":"news_article","archive_url":"http://web.archive.org/web/20260727174849/https://forklog.com/en/coinspect-warns-of-vulnerability-threatening-thousands-of-crypto-wallets/","credibility":2,"archive_timestamp":"2026-07-27T17:48:49+00:00"},{"url":"https://beincrypto.com/ill-bloom-vulnerability-crypto-wallets/","name":"Ill Bloom Vulnerability Drains $3.1 Million From Crypto Wallets: Are You Exposed? — BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/","name":"Coinspect warns Ill Bloom flaw may drain more crypto wallets — Crypto.news","type":"news_article","archive_url":"https://web.archive.org/web/20260727204413/https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/","credibility":2,"archive_timestamp":"2026-07-27T20:44:13+00:00"},{"url":"https://x.com/coinspect/status/2073935687770890458","name":"Coinspect Security on X — public disclosure announcement","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-08-07T23:17:32.995827+00:00","updated_at":"2026-10-30T12:13:59.443+00:00"},"source_quality":{"total":20,"tier1":0,"tier2":0,"tier3":1,"unrated":19},"follower_count":null,"content_updated_at":"2026-10-30T12:14:00.334Z","last_fact_checked_at":"2026-10-30T12:13:59.840Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}