Audit log

Every state-changing event for CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-07 23:17:44Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 443,504,836

   sig

   5ctRxGZiP4bN…18DbTbHtcopyexplorer ↗

   hash

   71v5SYqKhiEc…Zt5bPLtbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (24738 B) ▸

   {"actor":"system:backfill","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","kind":"publish","page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","published_at":"2026-08-07T23:17:44.126Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)","sections":[{"content":"CVE-2026-71851 (GitHub Advisory GHSA-rg76-677x-56q9) describes a twelve-year-old cryptographic design flaw in the widely used crypto-js JavaScript library. In versions 3.1.2-4 through 3.3.x, the function CryptoJS.lib.WordArray.random() — relied upon by developers to generate cryptographic keys, initialization vectors, and BIP39 mnemonic seed phrases — used a custom Multiply-With-Carry (MWC) pseudorandom number generator (PRNG) seeded by JavaScript's non-cryptographic Math.random(). Because Math.random() is seeded from the host environment's state rather than a cryptographically secure source, the seed initialization via Math.random() * 0x100000000 truncates effective entropy to 32 bits, with additional word-generation sign-choice entropy bringing the practical ceiling to approximately 2^39 bits for nominally 128-bit keys and approximately 2^47 bits for nominally 256-bit keys. The National Vulnerability Database and CVEReports assigned a CVSS v3.1 base score of 9.0 (Critical), with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The vulnerability was introduced on June 19, 2014. Versions 3.2.0 and 3.2.1 briefly corrected the flaw by using native cryptographic randomness, but version 3.3.0 reverted the fix, characterizing the secure change as 'breaking.' A robust patch was released in version 4.0.0 on approximately May 1, 2020, meaning the vulnerability was publicly patchable six years before active exploitation was documented. The library has been effectively unmaintained since 2023. Coinspect identified ferrumnet/bip39, a React Native fork that replaced upstream bip39's native cryptographic randomness with CryptoJS's insecure function, as one specific propagation vector into wallet software.","heading":"Vulnerability Overview","severity":"critical","sources":[{"credibility":2,"name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","url":"https://cvereports.com/reports/CVE-2026-71851"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","url":"https://www.coinspect.com/blog/ill-bloom-investigation/"},{"credibility":2,"name":"ALERT/WARNING: All users of crypto-js must replace by crypto-es (CVE-2023-46233 and others) · Issue #536 · brix/crypto-js | GitHub","type":"official","url":"https://github.com/brix/crypto-js/issues/536"}]},{"content":"Coinspect's investigation confirmed five wallet applications used CryptoJS.lib.WordArray.random() as an entropy source during recovery-phrase generation, exposing wallets created with those applications to offline brute-force attacks.\n\nRRWallet: Discontinued; no patch possible. Users have no remediation path other than migrating funds from seed phrases generated with affected versions.\n\nMilo: Discontinued; no patch possible. Same remediation constraint applies.\n\nBexo Wallet: Patch released in version 20.1.0. As of the August 2026 disclosure, updated builds had not yet been uploaded to distribution channels, meaning users may be running unpatched versions.\n\nNanChat: Independently confirmed affected versions prior to 1.3.0. Fixed in version 1.3.0.\n\nBitcoin Libre: Fixed in version 4 (released July 2024, predating the exploitation campaign). Users on version 4 or later are not exposed.\n\nHardware wallets (Ledger, Trezor, and similar dedicated physical devices) are unaffected, as they rely on hardware-level cryptographic random number generation rather than software PRNGs. Most mainstream software wallets are also reported unaffected. Coinspect noted wallets generated as early as 2018 have been identified as vulnerable, with affected addresses documented across at least Bitcoin, Ethereum, Tron, Rootstock, Polygon, and additional EVM-compatible chains.","heading":"Affected Wallet Applications","severity":"critical","sources":[{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/"},{"credibility":2,"name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","url":"https://illbloom.org/"}]},{"content":"Coinspect identified active exploitation beginning on May 27, 2026, in the form of a coordinated sweep. In that single day, attackers compromised 431 wallet accounts, siphoning approximately $3.14 million. Bitcoin holders suffered the largest losses at $2.57 million, including one address that held $1.1 million. Ethereum, Rootstock, Tron, and Polygon users sustained additional losses ranging from approximately $23,000 to $286,000 per network.\n\nA second exploitation wave ran from approximately May 30 through July 13, 2026, draining approximately $2.55 million from 522 additional seeds. A single Tron-based account lost approximately $2.18 million in USDT during a drain event on or around July 4, 2026. On July 20–21, 2026, further drains targeting Chinese-mnemonic wallets were documented.\n\nAs of the August 2026 public disclosure, Coinspect identified at least 2,114 vulnerable addresses across multiple blockchains, with confirmed measured losses of approximately $5.69 million. The historical peak value of the identified vulnerable address set reached $12.56 million in 2022, suggesting the true potential exposure was substantially higher. Coinspect characterized the $5.69 million figure as a lower bound. The attack methodology requires no physical access: attackers enumerate all outputs the weak PRNG could produce, convert each to BIP39 mnemonic phrases, derive the corresponding wallet addresses, and cross-reference public blockchain records to identify and drain funded accounts.","heading":"Exploitation Campaign and Measured Losses","severity":"critical","sources":[{"credibility":2,"name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"credibility":2,"name":"'Ill Bloom' flaw puts 2,114 digital wallets at risk: report | CoinGeek","type":"news_article","url":"https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/"},{"credibility":2,"name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/"},{"credibility":2,"name":"Ill Bloom Vulnerability Drains $5 Million from Crypto Wallets | Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/06/ill-bloom-vulnerability-crypto-wallets/"}]},{"content":"The cryptographic weakness arises from the design of CryptoJS.lib.WordArray.random() in affected versions. The function's Multiply-With-Carry PRNG is initialized using Math.random() * 0x100000000, casting JavaScript's floating-point Math.random() output to a 32-bit integer seed. JavaScript's Math.random() is specified as non-cryptographic and may be seeded deterministically from process or time state, yielding at most 48 bits of effective state and commonly far less. As a result, a nominally 128-bit key space collapses to approximately 2^39 effective bits, and a nominally 256-bit key space collapses to approximately 2^47 effective bits. Because the entropy is constrained at key-generation time, no downstream cryptographic processing — including BIP39 PBKDF2 derivation — can restore it. An attacker with knowledge of the affected library can enumerate the generator's full output space without requiring access to the victim device, network, or account, making the attack entirely passive and offline. Researchers noted that standard home computers are capable of completing such an enumeration within a realistic timeframe, as opposed to computational scales that would exceed the age of the universe that properly seeded 128-bit entropy would require. The propagation path in at least one confirmed case was through ferrumnet/bip39, a React Native fork of the standard bip39 library that substituted CryptoJS's insecure random function for the upstream library's native cryptographic source.","heading":"Technical Root Cause: Entropy Collapse","severity":"critical","sources":[{"credibility":2,"name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","url":"https://cvereports.com/reports/CVE-2026-71851"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","url":"https://www.coinspect.com/blog/ill-bloom-investigation/"}]},{"content":"Coinspect, a blockchain security firm with over twelve years of operating history, identified the vulnerability while investigating a wallet-drain incident that began in May 2026. The firm employed a staged disclosure approach: an initial partial disclosure occurred on or around July 6–10, 2026, identifying the vulnerability class and publishing a free address-checker tool at illbloom.org to allow users to assess exposure. Full technical attribution — linking the vulnerability directly to CryptoJS and naming the five affected wallet applications — was published on August 5, 2026, via Coinspect's blog. The GitHub Security Advisory GHSA-rg76-677x-56q9 and CVE-2026-71851 were formally published on August 5–7, 2026. Coinspect withheld specific exploit implementation details during the initial disclosure phase to limit immediate risk to users with remaining funds in vulnerable accounts. The security firm SlowMist was noted as monitoring the threat as of the initial disclosure, indicating broader industry awareness. Coinspect also developed and published the illbloom.org public checker tool as part of the coordinated response.","heading":"Disclosure Timeline and Researcher Attribution","severity":"medium","sources":[{"credibility":2,"name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","url":"https://www.coinspect.com/blog/ill-bloom-investigation/"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","url":"https://illbloom.org/"},{"credibility":2,"name":"Thousands of crypto wallets at risk from 'Ill Bloom' vulnerability: Coinspect | TradingView / Cointelegraph","type":"news_article","url":"https://www.tradingview.com/news/cointelegraph:e1ab8d173094b:0-thousands-of-crypto-wallets-at-risk-from-ill-bloom-vulnerability-coinspect/"}]},{"content":"Coinspect and independent security researchers are consistent that patching the wallet application alone is insufficient remediation. Because the entropy deficiency is introduced at the moment of seed-phrase generation and cannot be corrected retroactively by cryptographic post-processing, any wallet whose recovery phrase was generated using an affected version of CryptoJS remains permanently at risk regardless of subsequent software updates. The only effective remediation is to generate a new wallet using non-affected software and migrate all funds to addresses derived from the new, securely generated seed phrase. Users of RRWallet and Milo — both of which have ceased operations — have no supported migration path and must rely on third-party compatible wallets to import and then migrate their funds. For Bexo Wallet users, a patch was released in version 20.1.0, but distribution-channel upload was pending as of the August 2026 disclosure; users must verify they have installed the patched build. NanChat users should update to version 1.3.0 or later. Bitcoin Libre users on version 4 (released July 2024) or later are not exposed. For developers, the recommended remediation is to upgrade to crypto-js version 4.0.0 or higher, or to override CryptoJS.lib.WordArray.random with a call to window.crypto.getRandomValues() (browser environments) or crypto.randomBytes() (Node.js environments). All secrets generated using affected versions must be considered permanently compromised and must be regenerated. Coinspect's free checker tool at illbloom.org allows users to check public wallet addresses for exposure to the vulnerability.","heading":"Remediation Guidance and User Risk","severity":"high","sources":[{"credibility":2,"name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","url":"https://cvereports.com/reports/CVE-2026-71851"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/"},{"credibility":2,"name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","url":"https://illbloom.org/"}]},{"content":"CryptoJS was widely embedded across hundreds of JavaScript and npm packages, and many wallet developers integrated it without awareness of the PRNG deficiency. The vulnerability's twelve-year lifespan (2014–2026 active exploitation) and the library's unmaintained status since 2023 highlight systemic supply-chain risk in cryptocurrency wallet development. The ill-bloom case bears structural similarity to the Randstorm vulnerability disclosed in November 2023 by Unciphered, which documented analogous weak-randomness issues in Bitcoin wallets generated via BitcoinJS between 2011 and 2015. As with Randstorm, the Ill Bloom attack surface cannot be patched retroactively and remains permanently open for wallets generated during the affected period. Security firm CertiK and others have flagged the broader class of Math.random()-dependent cryptographic implementations as a recurring risk in the JavaScript ecosystem. The illbloom.org checker tool and Coinspect's staged disclosure represent current best practice for managing ongoing exploitation risk during coordinated vulnerability disclosure.","heading":"Broader Context: Supply Chain and Ecosystem Risk","severity":"high","sources":[{"credibility":2,"name":"Randstorm: You Can't Patch a House of Cards | Unciphered","type":"research","url":"https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/"},{"credibility":2,"name":"Cryptocurrency wallets might be vulnerable to 'Randstorm' flaw | TechTarget","type":"news_article","url":"https://www.techtarget.com/searchsecurity/news/366559456/Cryptocurrency-wallets-might-be-vulnerable-to-Randstorm-flaw"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","url":"https://www.coinspect.com/blog/ill-bloom-investigation/"}]}],"sources_used":[{"credibility":2,"name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","url":"https://cvereports.com/reports/CVE-2026-71851"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"credibility":2,"name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","url":"https://www.coinspect.com/blog/ill-bloom-investigation/"},{"credibility":2,"name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","url":"https://illbloom.org/"},{"credibility":2,"name":"'Ill Bloom' flaw puts 2,114 digital wallets at risk: report | CoinGeek","type":"news_article","url":"https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/"},{"credibility":2,"name":"Ill Bloom Vulnerability Drains $5 Million from Crypto Wallets | Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/06/ill-bloom-vulnerability-crypto-wallets/"},{"credibility":2,"name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/"},{"credibility":2,"name":"Crypto Wallets Lose $5M to Broken Random Number Generator: Ill Bloom Disclosure | TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/319796/20260706/crypto-wallets-lose-5m-broken-random-number-generator-ill-bloom-disclosure.htm"},{"credibility":2,"name":"Crypto wallets at risk from 'Ill Bloom' vulnerability, $5M stolen | Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/crypto-wallets-at-risk-from-ill-bloom-vulnerability-5m-stolen/"},{"credibility":2,"name":"Thousands of crypto wallets at risk from 'Ill Bloom' vulnerability: Coinspect | TradingView / Cointelegraph","type":"news_article","url":"https://www.tradingview.com/news/cointelegraph:e1ab8d173094b:0-thousands-of-crypto-wallets-at-risk-from-ill-bloom-vulnerability-coinspect/"},{"credibility":2,"name":"'Ill Bloom' Vulnerability Endangers Crypto Wallets | Phemex News","type":"news_article","url":"https://phemex.com/news/article/ill-bloom-wallet-vulnerability-threatens-thousands-of-crypto-accounts-91917"},{"credibility":2,"name":"Randstorm: You Can't Patch a House of Cards | Unciphered","type":"research","url":"https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/"},{"credibility":2,"name":"Cryptocurrency wallets might be vulnerable to 'Randstorm' flaw | TechTarget","type":"news_article","url":"https://www.techtarget.com/searchsecurity/news/366559456/Cryptocurrency-wallets-might-be-vulnerable-to-Randstorm-flaw"},{"credibility":2,"name":"ALERT/WARNING: All users of crypto-js must replace by crypto-es | GitHub Issue #536","type":"official","url":"https://github.com/brix/crypto-js/issues/536"},{"credibility":3,"name":"July 2026 Crypto Hacks: $242M+ Lost | CoinMonks / Medium","type":"news_article","url":"https://medium.com/coinmonks/july-2026-crypto-hacks-242m-lost-as-a-hardware-wallet-bug-outweighed-every-defi-exploit-56ef16f82dc5"}],"summary":"CVE-2026-71851, designated 'Ill Bloom' by Coinspect, is a critical (CVSS 9.0) cryptographic vulnerability in the crypto-js npm library affecting versions 3.1.2-4 through 3.3.x, in which the library's CryptoJS.lib.WordArray.random() function used a Math.random()-seeded Multiply-With-Carry algorithm rather than a cryptographically secure PRNG, collapsing intended 128-bit entropy to approximately 2^39 bits. Active exploitation was identified from May 27, 2026, with measured losses of at least $5.69 million across at least 2,114 vulnerable wallet addresses tied to five named applications: RRWallet, Milo (both discontinued), Bexo Wallet, NanChat, and Bitcoin Libre. Public CVE disclosure occurred on August 5–7, 2026, following a staged disclosure process by Coinspect.","timeline":[{"date":"2014-06-19","event":"Vulnerable Multiply-With-Carry PRNG seeded by Math.random() introduced into crypto-js codebase.","source":"CVEReports / Coinspect","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2020-02-10","event":"A flawed wrapper patch committed to crypto-js; did not fully resolve the entropy issue.","source":"CVEReports","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2020-05-01","event":"crypto-js version 4.0.0 released, permanently restoring native cryptographic randomness and resolving the vulnerability for new users.","source":"CVEReports / The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2023-01-01","event":"crypto-js library becomes effectively unmaintained. Versions prior to 4.0.0 remain in use across downstream npm packages.","source":"CVEReports / Coinspect","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2026-05-01","event":"Coinspect identifies active wallet drain exploitation linked to the weak PRNG; internal investigation begins.","source":"CVEReports","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2026-05-27","event":"First large-scale coordinated sweep: 431 wallet accounts drained in one day, totaling approximately $3.14 million. Bitcoin losses represent $2.57 million of the total.","source":"The Hacker News / CoinGeek / CoinTurk","source_url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"date":"2026-05-30","event":"Second exploitation wave begins, continuing through July 13, 2026. 522 additional seeds drained for approximately $2.55 million.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2026-06-10","event":"Coinspect identifies additional exposed funds but is unable to alert the wallet owner in time to prevent subsequent drain.","source":"The Hacker News (July disclosure article)","source_url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"date":"2026-06-30","event":"Coinspect confirms 2,114 exposed addresses identified across multiple blockchains.","source":"CoinGeek / TradingView / Cointelegraph","source_url":"https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/"},{"date":"2026-07-04","event":"Single Tron-based account loses approximately $2.18 million in USDT in a drain event during the second sweep.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2026-07-06","event":"Coinspect publishes initial partial disclosure of the Ill Bloom vulnerability; illbloom.org address-checker tool released. Security firm SlowMist acknowledges monitoring.","source":"Cryptonomist / CoinGeek / Crypto Briefing / TechTimes","source_url":"https://en.cryptonomist.ch/2026/07/06/ill-bloom-vulnerability-crypto-wallets/"},{"date":"2026-07-13","event":"Second exploitation sweep ends, per Coinspect's on-chain analysis.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2026-07-20","event":"Drains targeting Chinese-mnemonic wallets documented on July 20–21, 2026.","source":"illbloom.org","source_url":"https://illbloom.org/"},{"date":"2026-08-05","event":"Full technical disclosure published by Coinspect, naming all five affected wallet applications and linking the root cause explicitly to crypto-js. GitHub Advisory GHSA-rg76-677x-56q9 and CVE-2026-71851 formally published.","source":"The Hacker News / CVEReports / Coinspect","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 27070220-6638-4c0d-8c02-9820a4eaa2edcopy
2. #2reviewby reviewerreviewer

   2026-08-27 03:34:06Z
   Score: 4 → 4 (no score change)
   The page's central, most falsifiable claim -- that CVE-2026-71851 / GHSA-rg76-677x-56q9 is a genuine, critical (CVSS 9.0) weak-RNG flaw in crypto-js's WordArray.random() -- checks out precisely against the primary GitHub Security Advisory, including the specific version range, the 3.2.0/3.2.1-then-reverted-in-3.3.0 detail, and the entropy-collapse figures. The page's most alarmable claim, that this vulnerability caused actual multi-wallet drains rather than merely being theoretically capable of doing so, is corroborated by the advisory itself and by multiple independent press outlets reporting matching dollar figures, wallet counts, and per-chain breakdowns -- it is not overstated. Two minor issues were found: a timeline date (crypto-js 'unmaintained since 2023') is stated as January 1 when the underlying evidence points to around October 2023, and a claim that CertiK flagged the broader Math.random() risk class as recurring is not substantiated by the source cited for it. No dead links, contradicted claims, or unsupported wallet-count/loss figures were found. version_id was returned as null by the input-generation script for this investigation.
   anchoranchored

   chain

   ●mainnet-betaslot 443,523,186

   sig

   4uoM1kWJ5uHR…EjR63uvMcopyexplorer ↗

   hash

   Fck7FHPNaWQC…xeAqT6pFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1558 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-27T03:34:06.632Z","decision":"review","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","new_score":4,"page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":4,"reason":"The page's central, most falsifiable claim -- that CVE-2026-71851 / GHSA-rg76-677x-56q9 is a genuine, critical (CVSS 9.0) weak-RNG flaw in crypto-js's WordArray.random() -- checks out precisely against the primary GitHub Security Advisory, including the specific version range, the 3.2.0/3.2.1-then-reverted-in-3.3.0 detail, and the entropy-collapse figures. The page's most alarmable claim, that this vulnerability caused actual multi-wallet drains rather than merely being theoretically capable of doing so, is corroborated by the advisory itself and by multiple independent press outlets reporting matching dollar figures, wallet counts, and per-chain breakdowns -- it is not overstated. Two minor issues were found: a timeline date (crypto-js 'unmaintained since 2023') is stated as January 1 when the underlying evidence points to around October 2023, and a claim that CertiK flagged the broader Math.random() risk class as recurring is not substantiated by the source cited for it. No dead links, contradicted claims, or unsupported wallet-count/loss figures were found. version_id was returned as null by the input-generation script for this investigation.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ffed19d4-8b40-4cb2-826d-dcaf86af176ccopy
3. #3review approveby judgejudge

   2026-08-27 03:34:06Z
   Score: 4 → 4 (no score change)
   Of 30 claims checked, 27 were confirmed directly against primary sources (the GitHub Security Advisory, Coinspect's own investigation posts, and independent press), none were disputed, and only 1 was unverifiable with 2 rated partially supported. Disputed_pct is 3.3%, well within the approve band. The page's most falsifiable claim -- the CVE identifier, its CVSS score/vector, affected version range, and the 3.2.0/3.2.1-then-reverted-in-3.3.0 detail (claim_findings[1]-[4]) -- was checked against the primary advisory itself and matches precisely. The page's most alarmable claim, that this flaw caused actual multi-wallet drains rather than a merely theoretical risk (claim_findings[12]), is corroborated by matching dollar figures, wallet counts, and per-chain breakdowns across the advisory and multiple independent outlets -- it does not overstate a capability as a realized loss. The two partially_supported findings (claim_findings[10] and claim_findings[28]) concern timeline dates stated with first-of-month precision that isn't independently corroborated to the day, consistent with a known rounding artifact rather than a substantive factual error. The single unverifiable finding (claim_findings[27]) is the page generalizing a source's narrower, single-incident statement about CertiK into a broader ecosystem-risk claim -- a minor overreach in a background section, not a core allegation. Coverage gaps are all medium or low priority, so no escalation is warranted on that basis.
   anchoranchored

   chain

   ●mainnet-betaslot 443,523,190

   sig

   4XbKMeSziZVS…jDJnn4zscopyexplorer ↗

   hash

   DR4y5zJc5cwm…aSjXodLXcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1895 B) ▸

   {"actor":"judge","decided_at":"2026-08-27T03:34:06.632Z","decision":"review_approve","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","new_score":4,"page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":4,"reason":"Of 30 claims checked, 27 were confirmed directly against primary sources (the GitHub Security Advisory, Coinspect's own investigation posts, and independent press), none were disputed, and only 1 was unverifiable with 2 rated partially supported. Disputed_pct is 3.3%, well within the approve band. The page's most falsifiable claim -- the CVE identifier, its CVSS score/vector, affected version range, and the 3.2.0/3.2.1-then-reverted-in-3.3.0 detail (claim_findings[1]-[4]) -- was checked against the primary advisory itself and matches precisely. The page's most alarmable claim, that this flaw caused actual multi-wallet drains rather than a merely theoretical risk (claim_findings[12]), is corroborated by matching dollar figures, wallet counts, and per-chain breakdowns across the advisory and multiple independent outlets -- it does not overstate a capability as a realized loss. The two partially_supported findings (claim_findings[10] and claim_findings[28]) concern timeline dates stated with first-of-month precision that isn't independently corroborated to the day, consistent with a known rounding artifact rather than a substantive factual error. The single unverifiable finding (claim_findings[27]) is the page generalizing a source's narrower, single-incident statement about CertiK into a broader ecosystem-risk claim -- a minor overreach in a background section, not a core allegation. Coverage gaps are all medium or low priority, so no escalation is warranted on that basis.","score_delta":0,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 498b8a02-9df4-4ef1-a3b5-6d32e3b03ef9copy