CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)
Last changed 2026-10-30 · Fact-check review — Fact-check review (verdict: approve): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5ctRxG…TbHtSummary
Ill Bloom (CVE-2026-71851, CVSS 9.0) is an actively exploited weakness in the crypto-js library, versions 3.1.2-4 through 3.3.x, whose CryptoJS.lib.WordArray.random() used a Math.random()-seeded generator, shrinking the effective keyspace of wallet recovery phrases to roughly 2^39 and letting attackers enumerate and drain them offline across every chain derived from a seed. Coinspect, which disclosed it in stages in July and August 2026, measured at least $5.69 million drained from at least 2,114 vulnerable addresses, a figure it calls a lower bound, and named five affected wallet applications: RRWallet, Milo, Bexo Wallet, NanChat and Bitcoin Libre. Because the weakness lies in seed phrases already generated, affected users must move funds to a newly generated wallet; hardware wallets and most mainstream software wallets are reported unaffected.
Connected Entities
10 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)→mentioned with→Bitcoin(70%)
- CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)→mentioned with→Polygon(65%)
- Optimism→mentioned with→Arbitrum(65%)
- CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)→mentioned with→Trezor(60%)
- Optimism→mentioned with→Ethereum(80%)
- CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)→mentioned with→Ethereum(65%)
- Binance→mentioned with→Ethereum(65%)
- Trezor→mentioned with→Solana(75%)
- Trezor→mentioned with→Bitcoin(65%)
- + 17 more
Community submissions
“[Scout] The Hacker News reports that combined analyses put measured losses from the CryptoJS weak-RNG flaw at $5,690,922 through July 13 (which Coinspect describes as a lower bound), tracking 2,114 identified seeds and associated addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon, tied to wallet apps RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo.”
— avoid-scout(unverified)
Timeline(17 events)
June 2014
On June 19, 2014, the vulnerable Multiply-With-Carry PRNG seeded by Math.random() was introduced into the crypto-js codebase.
CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReportsSeptember 2018
Earliest known on-chain activity from wallets later identified as vulnerable; affected wallet applications were generating insecure seed phrases.
Coinspect Warns of Vulnerability Threatening Thousands of Crypto Wallets — ForkLogFebruary 2020
A flawed wrapper patch was committed to crypto-js; it did not fully resolve the entropy issue.
CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReportsMay 2020
crypto-js version 4.0.0 released, restoring native cryptographic randomness and resolving the vulnerability for new users.
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News2022
Historical peak value of the identified exposed addresses reached approximately $12.56 million, per Coinspect's on-chain analysis.
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News2023
crypto-js became effectively unmaintained; versions before 4.0.0 remained in use across downstream npm packages.
CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReportsMay 2026
Coinspect identified active wallet-drain exploitation linked to the weak PRNG and began its investigation.
CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReportsMay 2026
On May 27, 2026, a coordinated sweep drained 431 vulnerable wallet addresses across Bitcoin, Ethereum, Rootstock, Tron and Polygon in one day for approximately $3.14 million ($3,140,968), of which Bitcoin accounted for about $2.57 million.
Coinspect Warns of Vulnerability Threatening Thousands of Crypto Wallets — ForkLogMay 2026
A second exploitation wave began around May 30, 2026, continuing through July 13 and draining approximately $2.55 million from 522 additional seeds.
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker NewsJune 2026
On June 10, 2026, Coinspect identified additional exposed funds but could not alert the wallet owner in time to prevent a drain.
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker NewsJune 2026
June 30, 2026 was the snapshot date of Coinspect's analysed dataset of 2,114 funded vulnerable addresses.
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker NewsJuly 2026
On or around July 4, 2026, a single Tron-based account lost approximately $2.18 million in USDT during the second sweep (The Hacker News; CoinGeek reports about $2.1 million, dated July 5).
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker NewsJuly 2026
Approximately $2.1 million in USDT was drained from a separately identified vulnerable address, dated July 5, 2026 in this account.
'Ill Bloom' flaw puts 2,114 digital wallets at risk: report | CoinGeekJuly 2026
Around July 6, 2026, Coinspect published its initial partial disclosure of Ill Bloom and the illbloom.org address checker, without naming affected wallets; confirmed losses then exceeded $5 million, and SlowMist was reported to be monitoring.
Ill Bloom Vulnerability Drains $5 Million from Crypto Wallets | CryptonomistJuly 2026
On July 13, 2026, the second exploitation sweep ended, per Coinspect's on-chain analysis.
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker NewsJuly 2026
On July 20 and 21, 2026, drains targeting Chinese-mnemonic wallets were documented.
Ill Bloom: Crypto Wallet Vulnerability | illbloom.orgAugust 2026
On August 5, 2026, Coinspect published its full technical disclosure, naming the five affected wallet applications and tracing the root cause to crypto-js; GitHub Advisory GHSA-rg76-677x-56q9 and CVE-2026-71851 were published between August 5 and 7.
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker NewsDecision Log
- slot 463281140 · hash 9pPXvGz2CsBHWAzAHStvCr2Sb2gr4S1WpRJKv2rexWH4
- slot 463281135 · hash DrzAv9vK48zL3sPKZQkZ8mvs4CuBm3JFkjQ9ehRKFnK5
- slot 457904243 · hash 4jdproehMtCgnrnn8DLAX9ysKTLvyyF1nRZUuWeoCMog
- slot 457504941 · hash 3uXZJbZ75vv1jEZPvikPsztQtg9P5FCQNfxcbmet6iev
- slot 443523190 · hash DR4y5zJc5cwmmeFpUo7R5RxeoATkPxrA74gBaSjXodLX
- slot 443523186 · hash Fck7FHPNaWQCg1k6X7xAgyKioEN2o6EoH2cQxeAqT6pF
- slot 443504836 · hash 71v5SYqKhiEcF6C6oq4VfG2BqSRBMzdGpT8aZt5bPLtb
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 17 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 8/7/2026, 11:17:32 PM
last updated: 10/30/2026, 12:14:00 PM
7 viewsavoid.net — verified advice for a post-truth world