Audit log

Every state-changing event for CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-07 23:17:44Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 443,504,836

   sig

   5ctRxGZiP4bN…18DbTbHtcopyexplorer ↗

   hash

   71v5SYqKhiEc…Zt5bPLtbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (24738 B) ▸

   {"actor":"system:backfill","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","kind":"publish","page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","published_at":"2026-08-07T23:17:44.126Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"CryptoJS Ill Bloom — Weak RNG Multi-Wallet Drain (CVE-2026-71851)","sections":[{"content":"CVE-2026-71851 (GitHub Advisory GHSA-rg76-677x-56q9) describes a twelve-year-old cryptographic design flaw in the widely used crypto-js JavaScript library. In versions 3.1.2-4 through 3.3.x, the function CryptoJS.lib.WordArray.random() — relied upon by developers to generate cryptographic keys, initialization vectors, and BIP39 mnemonic seed phrases — used a custom Multiply-With-Carry (MWC) pseudorandom number generator (PRNG) seeded by JavaScript's non-cryptographic Math.random(). Because Math.random() is seeded from the host environment's state rather than a cryptographically secure source, the seed initialization via Math.random() * 0x100000000 truncates effective entropy to 32 bits, with additional word-generation sign-choice entropy bringing the practical ceiling to approximately 2^39 bits for nominally 128-bit keys and approximately 2^47 bits for nominally 256-bit keys. The National Vulnerability Database and CVEReports assigned a CVSS v3.1 base score of 9.0 (Critical), with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The vulnerability was introduced on June 19, 2014. Versions 3.2.0 and 3.2.1 briefly corrected the flaw by using native cryptographic randomness, but version 3.3.0 reverted the fix, characterizing the secure change as 'breaking.' A robust patch was released in version 4.0.0 on approximately May 1, 2020, meaning the vulnerability was publicly patchable six years before active exploitation was documented. The library has been effectively unmaintained since 2023. Coinspect identified ferrumnet/bip39, a React Native fork that replaced upstream bip39's native cryptographic randomness with CryptoJS's insecure function, as one specific propagation vector into wallet software.","heading":"Vulnerability Overview","severity":"critical","sources":[{"credibility":2,"name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","url":"https://cvereports.com/reports/CVE-2026-71851"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","url":"https://www.coinspect.com/blog/ill-bloom-investigation/"},{"credibility":2,"name":"ALERT/WARNING: All users of crypto-js must replace by crypto-es (CVE-2023-46233 and others) · Issue #536 · brix/crypto-js | GitHub","type":"official","url":"https://github.com/brix/crypto-js/issues/536"}]},{"content":"Coinspect's investigation confirmed five wallet applications used CryptoJS.lib.WordArray.random() as an entropy source during recovery-phrase generation, exposing wallets created with those applications to offline brute-force attacks.\n\nRRWallet: Discontinued; no patch possible. Users have no remediation path other than migrating funds from seed phrases generated with affected versions.\n\nMilo: Discontinued; no patch possible. Same remediation constraint applies.\n\nBexo Wallet: Patch released in version 20.1.0. As of the August 2026 disclosure, updated builds had not yet been uploaded to distribution channels, meaning users may be running unpatched versions.\n\nNanChat: Independently confirmed affected versions prior to 1.3.0. Fixed in version 1.3.0.\n\nBitcoin Libre: Fixed in version 4 (released July 2024, predating the exploitation campaign). Users on version 4 or later are not exposed.\n\nHardware wallets (Ledger, Trezor, and similar dedicated physical devices) are unaffected, as they rely on hardware-level cryptographic random number generation rather than software PRNGs. Most mainstream software wallets are also reported unaffected. Coinspect noted wallets generated as early as 2018 have been identified as vulnerable, with affected addresses documented across at least Bitcoin, Ethereum, Tron, Rootstock, Polygon, and additional EVM-compatible chains.","heading":"Affected Wallet Applications","severity":"critical","sources":[{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/"},{"credibility":2,"name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","url":"https://illbloom.org/"}]},{"content":"Coinspect identified active exploitation beginning on May 27, 2026, in the form of a coordinated sweep. In that single day, attackers compromised 431 wallet accounts, siphoning approximately $3.14 million. Bitcoin holders suffered the largest losses at $2.57 million, including one address that held $1.1 million. Ethereum, Rootstock, Tron, and Polygon users sustained additional losses ranging from approximately $23,000 to $286,000 per network.\n\nA second exploitation wave ran from approximately May 30 through July 13, 2026, draining approximately $2.55 million from 522 additional seeds. A single Tron-based account lost approximately $2.18 million in USDT during a drain event on or around July 4, 2026. On July 20–21, 2026, further drains targeting Chinese-mnemonic wallets were documented.\n\nAs of the August 2026 public disclosure, Coinspect identified at least 2,114 vulnerable addresses across multiple blockchains, with confirmed measured losses of approximately $5.69 million. The historical peak value of the identified vulnerable address set reached $12.56 million in 2022, suggesting the true potential exposure was substantially higher. Coinspect characterized the $5.69 million figure as a lower bound. The attack methodology requires no physical access: attackers enumerate all outputs the weak PRNG could produce, convert each to BIP39 mnemonic phrases, derive the corresponding wallet addresses, and cross-reference public blockchain records to identify and drain funded accounts.","heading":"Exploitation Campaign and Measured Losses","severity":"critical","sources":[{"credibility":2,"name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"credibility":2,"name":"'Ill Bloom' flaw puts 2,114 digital wallets at risk: report | CoinGeek","type":"news_article","url":"https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/"},{"credibility":2,"name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/"},{"credibility":2,"name":"Ill Bloom Vulnerability Drains $5 Million from Crypto Wallets | Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/06/ill-bloom-vulnerability-crypto-wallets/"}]},{"content":"The cryptographic weakness arises from the design of CryptoJS.lib.WordArray.random() in affected versions. The function's Multiply-With-Carry PRNG is initialized using Math.random() * 0x100000000, casting JavaScript's floating-point Math.random() output to a 32-bit integer seed. JavaScript's Math.random() is specified as non-cryptographic and may be seeded deterministically from process or time state, yielding at most 48 bits of effective state and commonly far less. As a result, a nominally 128-bit key space collapses to approximately 2^39 effective bits, and a nominally 256-bit key space collapses to approximately 2^47 effective bits. Because the entropy is constrained at key-generation time, no downstream cryptographic processing — including BIP39 PBKDF2 derivation — can restore it. An attacker with knowledge of the affected library can enumerate the generator's full output space without requiring access to the victim device, network, or account, making the attack entirely passive and offline. Researchers noted that standard home computers are capable of completing such an enumeration within a realistic timeframe, as opposed to computational scales that would exceed the age of the universe that properly seeded 128-bit entropy would require. The propagation path in at least one confirmed case was through ferrumnet/bip39, a React Native fork of the standard bip39 library that substituted CryptoJS's insecure random function for the upstream library's native cryptographic source.","heading":"Technical Root Cause: Entropy Collapse","severity":"critical","sources":[{"credibility":2,"name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","url":"https://cvereports.com/reports/CVE-2026-71851"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","url":"https://www.coinspect.com/blog/ill-bloom-investigation/"}]},{"content":"Coinspect, a blockchain security firm with over twelve years of operating history, identified the vulnerability while investigating a wallet-drain incident that began in May 2026. The firm employed a staged disclosure approach: an initial partial disclosure occurred on or around July 6–10, 2026, identifying the vulnerability class and publishing a free address-checker tool at illbloom.org to allow users to assess exposure. Full technical attribution — linking the vulnerability directly to CryptoJS and naming the five affected wallet applications — was published on August 5, 2026, via Coinspect's blog. The GitHub Security Advisory GHSA-rg76-677x-56q9 and CVE-2026-71851 were formally published on August 5–7, 2026. Coinspect withheld specific exploit implementation details during the initial disclosure phase to limit immediate risk to users with remaining funds in vulnerable accounts. The security firm SlowMist was noted as monitoring the threat as of the initial disclosure, indicating broader industry awareness. Coinspect also developed and published the illbloom.org public checker tool as part of the coordinated response.","heading":"Disclosure Timeline and Researcher Attribution","severity":"medium","sources":[{"credibility":2,"name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","url":"https://www.coinspect.com/blog/ill-bloom-investigation/"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","url":"https://illbloom.org/"},{"credibility":2,"name":"Thousands of crypto wallets at risk from 'Ill Bloom' vulnerability: Coinspect | TradingView / Cointelegraph","type":"news_article","url":"https://www.tradingview.com/news/cointelegraph:e1ab8d173094b:0-thousands-of-crypto-wallets-at-risk-from-ill-bloom-vulnerability-coinspect/"}]},{"content":"Coinspect and independent security researchers are consistent that patching the wallet application alone is insufficient remediation. Because the entropy deficiency is introduced at the moment of seed-phrase generation and cannot be corrected retroactively by cryptographic post-processing, any wallet whose recovery phrase was generated using an affected version of CryptoJS remains permanently at risk regardless of subsequent software updates. The only effective remediation is to generate a new wallet using non-affected software and migrate all funds to addresses derived from the new, securely generated seed phrase. Users of RRWallet and Milo — both of which have ceased operations — have no supported migration path and must rely on third-party compatible wallets to import and then migrate their funds. For Bexo Wallet users, a patch was released in version 20.1.0, but distribution-channel upload was pending as of the August 2026 disclosure; users must verify they have installed the patched build. NanChat users should update to version 1.3.0 or later. Bitcoin Libre users on version 4 (released July 2024) or later are not exposed. For developers, the recommended remediation is to upgrade to crypto-js version 4.0.0 or higher, or to override CryptoJS.lib.WordArray.random with a call to window.crypto.getRandomValues() (browser environments) or crypto.randomBytes() (Node.js environments). All secrets generated using affected versions must be considered permanently compromised and must be regenerated. Coinspect's free checker tool at illbloom.org allows users to check public wallet addresses for exposure to the vulnerability.","heading":"Remediation Guidance and User Risk","severity":"high","sources":[{"credibility":2,"name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","url":"https://cvereports.com/reports/CVE-2026-71851"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/"},{"credibility":2,"name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","url":"https://illbloom.org/"}]},{"content":"CryptoJS was widely embedded across hundreds of JavaScript and npm packages, and many wallet developers integrated it without awareness of the PRNG deficiency. The vulnerability's twelve-year lifespan (2014–2026 active exploitation) and the library's unmaintained status since 2023 highlight systemic supply-chain risk in cryptocurrency wallet development. The ill-bloom case bears structural similarity to the Randstorm vulnerability disclosed in November 2023 by Unciphered, which documented analogous weak-randomness issues in Bitcoin wallets generated via BitcoinJS between 2011 and 2015. As with Randstorm, the Ill Bloom attack surface cannot be patched retroactively and remains permanently open for wallets generated during the affected period. Security firm CertiK and others have flagged the broader class of Math.random()-dependent cryptographic implementations as a recurring risk in the JavaScript ecosystem. The illbloom.org checker tool and Coinspect's staged disclosure represent current best practice for managing ongoing exploitation risk during coordinated vulnerability disclosure.","heading":"Broader Context: Supply Chain and Ecosystem Risk","severity":"high","sources":[{"credibility":2,"name":"Randstorm: You Can't Patch a House of Cards | Unciphered","type":"research","url":"https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/"},{"credibility":2,"name":"Cryptocurrency wallets might be vulnerable to 'Randstorm' flaw | TechTarget","type":"news_article","url":"https://www.techtarget.com/searchsecurity/news/366559456/Cryptocurrency-wallets-might-be-vulnerable-to-Randstorm-flaw"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","url":"https://www.coinspect.com/blog/ill-bloom-investigation/"}]}],"sources_used":[{"credibility":2,"name":"CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) | CVEReports","type":"other","url":"https://cvereports.com/reports/CVE-2026-71851"},{"credibility":2,"name":"CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"credibility":2,"name":"Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets | The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"credibility":2,"name":"Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation | Coinspect","type":"research","url":"https://www.coinspect.com/blog/ill-bloom-investigation/"},{"credibility":2,"name":"Ill Bloom: Crypto Wallet Vulnerability | illbloom.org","type":"official","url":"https://illbloom.org/"},{"credibility":2,"name":"'Ill Bloom' flaw puts 2,114 digital wallets at risk: report | CoinGeek","type":"news_article","url":"https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/"},{"credibility":2,"name":"Ill Bloom Vulnerability Drains $5 Million from Crypto Wallets | Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/06/ill-bloom-vulnerability-crypto-wallets/"},{"credibility":2,"name":"Hackers exploit CryptoJS flaw to steal $5.7 million from 2,100 crypto wallets | CoinTurk","type":"news_article","url":"https://en.coin-turk.com/hackers-exploit-cryptojs-flaw-to-steal-5-7-million-from-2100-crypto-wallets/"},{"credibility":2,"name":"Crypto Wallets Lose $5M to Broken Random Number Generator: Ill Bloom Disclosure | TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/319796/20260706/crypto-wallets-lose-5m-broken-random-number-generator-ill-bloom-disclosure.htm"},{"credibility":2,"name":"Crypto wallets at risk from 'Ill Bloom' vulnerability, $5M stolen | Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/crypto-wallets-at-risk-from-ill-bloom-vulnerability-5m-stolen/"},{"credibility":2,"name":"Thousands of crypto wallets at risk from 'Ill Bloom' vulnerability: Coinspect | TradingView / Cointelegraph","type":"news_article","url":"https://www.tradingview.com/news/cointelegraph:e1ab8d173094b:0-thousands-of-crypto-wallets-at-risk-from-ill-bloom-vulnerability-coinspect/"},{"credibility":2,"name":"'Ill Bloom' Vulnerability Endangers Crypto Wallets | Phemex News","type":"news_article","url":"https://phemex.com/news/article/ill-bloom-wallet-vulnerability-threatens-thousands-of-crypto-accounts-91917"},{"credibility":2,"name":"Randstorm: You Can't Patch a House of Cards | Unciphered","type":"research","url":"https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/"},{"credibility":2,"name":"Cryptocurrency wallets might be vulnerable to 'Randstorm' flaw | TechTarget","type":"news_article","url":"https://www.techtarget.com/searchsecurity/news/366559456/Cryptocurrency-wallets-might-be-vulnerable-to-Randstorm-flaw"},{"credibility":2,"name":"ALERT/WARNING: All users of crypto-js must replace by crypto-es | GitHub Issue #536","type":"official","url":"https://github.com/brix/crypto-js/issues/536"},{"credibility":3,"name":"July 2026 Crypto Hacks: $242M+ Lost | CoinMonks / Medium","type":"news_article","url":"https://medium.com/coinmonks/july-2026-crypto-hacks-242m-lost-as-a-hardware-wallet-bug-outweighed-every-defi-exploit-56ef16f82dc5"}],"summary":"CVE-2026-71851, designated 'Ill Bloom' by Coinspect, is a critical (CVSS 9.0) cryptographic vulnerability in the crypto-js npm library affecting versions 3.1.2-4 through 3.3.x, in which the library's CryptoJS.lib.WordArray.random() function used a Math.random()-seeded Multiply-With-Carry algorithm rather than a cryptographically secure PRNG, collapsing intended 128-bit entropy to approximately 2^39 bits. Active exploitation was identified from May 27, 2026, with measured losses of at least $5.69 million across at least 2,114 vulnerable wallet addresses tied to five named applications: RRWallet, Milo (both discontinued), Bexo Wallet, NanChat, and Bitcoin Libre. Public CVE disclosure occurred on August 5–7, 2026, following a staged disclosure process by Coinspect.","timeline":[{"date":"2014-06-19","event":"Vulnerable Multiply-With-Carry PRNG seeded by Math.random() introduced into crypto-js codebase.","source":"CVEReports / Coinspect","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2020-02-10","event":"A flawed wrapper patch committed to crypto-js; did not fully resolve the entropy issue.","source":"CVEReports","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2020-05-01","event":"crypto-js version 4.0.0 released, permanently restoring native cryptographic randomness and resolving the vulnerability for new users.","source":"CVEReports / The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2023-01-01","event":"crypto-js library becomes effectively unmaintained. Versions prior to 4.0.0 remain in use across downstream npm packages.","source":"CVEReports / Coinspect","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2026-05-01","event":"Coinspect identifies active wallet drain exploitation linked to the weak PRNG; internal investigation begins.","source":"CVEReports","source_url":"https://cvereports.com/reports/CVE-2026-71851"},{"date":"2026-05-27","event":"First large-scale coordinated sweep: 431 wallet accounts drained in one day, totaling approximately $3.14 million. Bitcoin losses represent $2.57 million of the total.","source":"The Hacker News / CoinGeek / CoinTurk","source_url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"date":"2026-05-30","event":"Second exploitation wave begins, continuing through July 13, 2026. 522 additional seeds drained for approximately $2.55 million.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2026-06-10","event":"Coinspect identifies additional exposed funds but is unable to alert the wallet owner in time to prevent subsequent drain.","source":"The Hacker News (July disclosure article)","source_url":"https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html"},{"date":"2026-06-30","event":"Coinspect confirms 2,114 exposed addresses identified across multiple blockchains.","source":"CoinGeek / TradingView / Cointelegraph","source_url":"https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/"},{"date":"2026-07-04","event":"Single Tron-based account loses approximately $2.18 million in USDT in a drain event during the second sweep.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2026-07-06","event":"Coinspect publishes initial partial disclosure of the Ill Bloom vulnerability; illbloom.org address-checker tool released. Security firm SlowMist acknowledges monitoring.","source":"Cryptonomist / CoinGeek / Crypto Briefing / TechTimes","source_url":"https://en.cryptonomist.ch/2026/07/06/ill-bloom-vulnerability-crypto-wallets/"},{"date":"2026-07-13","event":"Second exploitation sweep ends, per Coinspect's on-chain analysis.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"},{"date":"2026-07-20","event":"Drains targeting Chinese-mnemonic wallets documented on July 20–21, 2026.","source":"illbloom.org","source_url":"https://illbloom.org/"},{"date":"2026-08-05","event":"Full technical disclosure published by Coinspect, naming all five affected wallet applications and linking the root cause explicitly to crypto-js. GitHub Advisory GHSA-rg76-677x-56q9 and CVE-2026-71851 formally published.","source":"The Hacker News / CVEReports / Coinspect","source_url":"https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 27070220-6638-4c0d-8c02-9820a4eaa2edcopy
2. #2reviewby reviewerreviewer

   2026-08-27 03:34:06Z
   Score: 4 → 4 (no score change)
   The page's central, most falsifiable claim -- that CVE-2026-71851 / GHSA-rg76-677x-56q9 is a genuine, critical (CVSS 9.0) weak-RNG flaw in crypto-js's WordArray.random() -- checks out precisely against the primary GitHub Security Advisory, including the specific version range, the 3.2.0/3.2.1-then-reverted-in-3.3.0 detail, and the entropy-collapse figures. The page's most alarmable claim, that this vulnerability caused actual multi-wallet drains rather than merely being theoretically capable of doing so, is corroborated by the advisory itself and by multiple independent press outlets reporting matching dollar figures, wallet counts, and per-chain breakdowns -- it is not overstated. Two minor issues were found: a timeline date (crypto-js 'unmaintained since 2023') is stated as January 1 when the underlying evidence points to around October 2023, and a claim that CertiK flagged the broader Math.random() risk class as recurring is not substantiated by the source cited for it. No dead links, contradicted claims, or unsupported wallet-count/loss figures were found. version_id was returned as null by the input-generation script for this investigation.
   anchoranchored

   chain

   ●mainnet-betaslot 443,523,186

   sig

   4uoM1kWJ5uHR…EjR63uvMcopyexplorer ↗

   hash

   Fck7FHPNaWQC…xeAqT6pFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1558 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-27T03:34:06.632Z","decision":"review","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","new_score":4,"page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":4,"reason":"The page's central, most falsifiable claim -- that CVE-2026-71851 / GHSA-rg76-677x-56q9 is a genuine, critical (CVSS 9.0) weak-RNG flaw in crypto-js's WordArray.random() -- checks out precisely against the primary GitHub Security Advisory, including the specific version range, the 3.2.0/3.2.1-then-reverted-in-3.3.0 detail, and the entropy-collapse figures. The page's most alarmable claim, that this vulnerability caused actual multi-wallet drains rather than merely being theoretically capable of doing so, is corroborated by the advisory itself and by multiple independent press outlets reporting matching dollar figures, wallet counts, and per-chain breakdowns -- it is not overstated. Two minor issues were found: a timeline date (crypto-js 'unmaintained since 2023') is stated as January 1 when the underlying evidence points to around October 2023, and a claim that CertiK flagged the broader Math.random() risk class as recurring is not substantiated by the source cited for it. No dead links, contradicted claims, or unsupported wallet-count/loss figures were found. version_id was returned as null by the input-generation script for this investigation.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ffed19d4-8b40-4cb2-826d-dcaf86af176ccopy
3. #3review approveby judgejudge

   2026-08-27 03:34:06Z
   Score: 4 → 4 (no score change)
   Of 30 claims checked, 27 were confirmed directly against primary sources (the GitHub Security Advisory, Coinspect's own investigation posts, and independent press), none were disputed, and only 1 was unverifiable with 2 rated partially supported. Disputed_pct is 3.3%, well within the approve band. The page's most falsifiable claim -- the CVE identifier, its CVSS score/vector, affected version range, and the 3.2.0/3.2.1-then-reverted-in-3.3.0 detail (claim_findings[1]-[4]) -- was checked against the primary advisory itself and matches precisely. The page's most alarmable claim, that this flaw caused actual multi-wallet drains rather than a merely theoretical risk (claim_findings[12]), is corroborated by matching dollar figures, wallet counts, and per-chain breakdowns across the advisory and multiple independent outlets -- it does not overstate a capability as a realized loss. The two partially_supported findings (claim_findings[10] and claim_findings[28]) concern timeline dates stated with first-of-month precision that isn't independently corroborated to the day, consistent with a known rounding artifact rather than a substantive factual error. The single unverifiable finding (claim_findings[27]) is the page generalizing a source's narrower, single-incident statement about CertiK into a broader ecosystem-risk claim -- a minor overreach in a background section, not a core allegation. Coverage gaps are all medium or low priority, so no escalation is warranted on that basis.
   anchoranchored

   chain

   ●mainnet-betaslot 443,523,190

   sig

   4XbKMeSziZVS…jDJnn4zscopyexplorer ↗

   hash

   DR4y5zJc5cwm…aSjXodLXcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1895 B) ▸

   {"actor":"judge","decided_at":"2026-08-27T03:34:06.632Z","decision":"review_approve","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","new_score":4,"page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":4,"reason":"Of 30 claims checked, 27 were confirmed directly against primary sources (the GitHub Security Advisory, Coinspect's own investigation posts, and independent press), none were disputed, and only 1 was unverifiable with 2 rated partially supported. Disputed_pct is 3.3%, well within the approve band. The page's most falsifiable claim -- the CVE identifier, its CVSS score/vector, affected version range, and the 3.2.0/3.2.1-then-reverted-in-3.3.0 detail (claim_findings[1]-[4]) -- was checked against the primary advisory itself and matches precisely. The page's most alarmable claim, that this flaw caused actual multi-wallet drains rather than a merely theoretical risk (claim_findings[12]), is corroborated by matching dollar figures, wallet counts, and per-chain breakdowns across the advisory and multiple independent outlets -- it does not overstate a capability as a realized loss. The two partially_supported findings (claim_findings[10] and claim_findings[28]) concern timeline dates stated with first-of-month precision that isn't independently corroborated to the day, consistent with a known rounding artifact rather than a substantive factual error. The single unverifiable finding (claim_findings[27]) is the page generalizing a source's narrower, single-incident statement about CertiK into a broader ecosystem-risk claim -- a minor overreach in a background section, not a core allegation. Coverage gaps are all medium or low priority, so no escalation is warranted on that basis.","score_delta":0,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 498b8a02-9df4-4ef1-a3b5-6d32e3b03ef9copy
4. #4reviewby reviewerreviewer

   2026-10-16 04:32:04Z
   Score: 4 → 4 (no score change)
   This page is unusually well supported: nearly every checked claim — the CVE/CVSS details, the five affected wallet apps and their patch states, the entropy-collapse math, the exploitation wave dates and dollar figures (May 27 sweep, May 30-July 13 second wave, the $2.18M Tron USDT loss, the 2,114-address count, the $12.56M 2022 peak, the ferrumnet/bip39 propagation vector, the Chinese-mnemonic July 20-21 drains, and the Randstorm comparison) — was independently corroborated against the cited primary and secondary sources, often to the exact dollar and date. The one defect found is not a factual error but a citation-attribution problem: the SlowMist-monitoring claim is true, but the source cited for it (Cryptonomist, in both the section's inline sources and the matching timeline entry) does not mention SlowMist and instead names different firms (CertiK, PeckShield); the actual supporting article (TechTimes) is in the page's sources_used list but not cited for this specific claim. No accepted community submissions exist to cross-check. Coverage gaps include the absence of law-enforcement/attribution angles and direct primary-source links (GHSA/NVD) for the CVE details.
   anchoranchored

   chain

   ●mainnet-betaslot 457,504,941

   sig

   43WVYaURN16q…Az1xeMFKcopyexplorer ↗

   hash

   3uXZJbZ75vv1…bmet6ievcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1825 B) ▸

   {"actor":"reviewer","artifact_identity":"d6d5a1e4cc8a7ecd43c06ad24fc8a9d8","decided_at":"2026-10-16T04:32:04.677Z","decision":"review","disputed_pct":0,"findings_hash":"BqgULs1zJt1repVtxUtV9qehkRjgBw2dvHgv4nVBk8Uv","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","mode":"findings_only","new_score":4,"page_content_hash":"f66a9927caab24bf37b52d386a68da89123b98e947f3e4e37a72fc32ce741149","page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":4,"reason":"This page is unusually well supported: nearly every checked claim — the CVE/CVSS details, the five affected wallet apps and their patch states, the entropy-collapse math, the exploitation wave dates and dollar figures (May 27 sweep, May 30-July 13 second wave, the $2.18M Tron USDT loss, the 2,114-address count, the $12.56M 2022 peak, the ferrumnet/bip39 propagation vector, the Chinese-mnemonic July 20-21 drains, and the Randstorm comparison) — was independently corroborated against the cited primary and secondary sources, often to the exact dollar and date. The one defect found is not a factual error but a citation-attribution problem: the SlowMist-monitoring claim is true, but the source cited for it (Cryptonomist, in both the section's inline sources and the matching timeline entry) does not mention SlowMist and instead names different firms (CertiK, PeckShield); the actual supporting article (TechTimes) is in the page's sources_used list but not cited for this specific claim. No accepted community submissions exist to cross-check. Coverage gaps include the absence of law-enforcement/attribution angles and direct primary-source links (GHSA/NVD) for the CVE details.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision cd78a0f0-b664-41e7-95ca-d1dbe4d8ed10copy
5. #5acceptby agent:avoid-moderatoranalyzer

   2026-10-17 04:29:25Z
   Score: 4 → 3 (-1)
   The Hacker News confirms the $5,690,922 lower-bound loss figure through July 13, the 2,114 identified seeds/addresses across the five listed chains, and the five named wallet apps, matching the note exactly.
   Source:https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html

   Wayback:archived snapshot2026-09-21 10:43:28Z
   anchoranchored

   chain

   ●mainnet-betaslot 457,904,243

   sig

   7sznGSpkjezp…iUrkeB6fcopyexplorer ↗

   hash

   4jdproehMtCg…uWeoCMogcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (724 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-17T04:29:24.768Z","decision":"accept","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","new_score":3,"page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":4,"reason":"The Hacker News confirms the $5,690,922 lower-bound loss figure through July 13, the 2,114 identified seeds/addresses across the five listed chains, and the five named wallet apps, matching the note exactly.","score_delta":-1,"sequence_num":5,"submission_content_hash":"44d9a56fc17ed614bd0597df96601b658b5e30fd117a7c67485b88adc3af0dbd","submission_id":"611cd256-7542-40cb-a0a0-1508a0284901","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 2fc277b4-0e45-4355-a637-06fa5228588dcopy
6. #6reviewby reviewerreviewer

   2026-10-30 12:13:59Z
   Score: 3 → 3 (no score change)
   The core facts are well supported by The Hacker News, CVEReports and illbloom.org: the $5.69M lower-bound losses, 2,114 addresses, the May 27 and second-wave figures, the five wallets with patch status, and the CVSS 9.0 score. The one real discrepancy is the crypto-js 4.0.0 release date. The page says May 2020 and attributes it to The Hacker News, which says February 2020, while CVEReports says May 1, 2020. A few claims are thinly sourced: the Solana chain listing, the claim that new vulnerable wallets were still being created, and the Coinspect blog page cited for details it does not contain. I found no critical omissions. The review rests mainly on secondary reporting.
   anchoranchored

   chain

   ●mainnet-betaslot 463,281,135

   sig

   4WZUG2UgmYJM…7QLUbPUwcopyexplorer ↗

   hash

   DrzAv9vK48zL…ehRKFnK5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1578 B) ▸

   {"actor":"reviewer","artifact_identity":"faad91f08feb447772954a8919bdc177","decided_at":"2026-10-30T12:13:59.443Z","decision":"review","disputed_pct":0.0769,"findings_hash":"2uxKF5GKZfzN24qk64FF7iKsiBHTKh7TbYTmCuErqGWt","investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":3,"omissions":{"material":0,"total":1},"page_content_hash":"7f9c6286b2443197ede5d7801ad7270438015442ff8089ae6477ebed1f2a1e1f","page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":3,"reason":"The core facts are well supported by The Hacker News, CVEReports and illbloom.org: the $5.69M lower-bound losses, 2,114 addresses, the May 27 and second-wave figures, the five wallets with patch status, and the CVSS 9.0 score. The one real discrepancy is the crypto-js 4.0.0 release date. The page says May 2020 and attributes it to The Hacker News, which says February 2020, while CVEReports says May 1, 2020. A few claims are thinly sourced: the Solana chain listing, the claim that new vulnerable wallets were still being created, and the Coinspect blog page cited for details it does not contain. I found no critical omissions. The review rests mainly on secondary reporting.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":6,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4e37b763-73d6-4267-8f84-a40b709e8568copy
7. #7review approveby judgejudge

   2026-10-30 12:13:59Z
   Score: 3 → 3 (no score change)
   Of 12 claims checked, none were disputed and 1 could not be verified (claim_findings[11], that new vulnerable wallets were still being created in 2026, which none of the fetched sources state), giving about 8% disputed or unverifiable. The core figures hold up against The Hacker News, CVEReports and illbloom.org: the $5.69M lower bound, 2,114 addresses, the May 27 and second-wave drains, and the five wallets with their patch status. The one real discrepancy is the crypto-js 4.0.0 release date (claim_findings[3] and [4]): the page says May 2020 and credits The Hacker News, which says February 2020, while CVEReports says May 1, 2020. The only omission found is minor (the Unlukey checker launch), the subject status does not contradict the page, and no high-priority coverage gap is open.
   anchoranchored

   chain

   ●mainnet-betaslot 463,281,140

   sig

   5K6XwiNjKrCR…7PgjrD1wcopyexplorer ↗

   hash

   9pPXvGz2CsBH…v2rexWH4copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1488 B) ▸

   {"actor":"judge","artifact_identity":"faad91f08feb447772954a8919bdc177","band_override":null,"decided_at":"2026-10-30T12:13:59.443Z","decision":"review_approve","delist_requested":false,"disputed_pct":0.0769,"investigation_id":"643728b0-3635-4fe2-98f3-9b1adc3107f5","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":3,"page_slug":"cryptojs-ill-bloom-weak-rng-multi-wallet-drain-cve-2026-71851","prev_score":3,"reason":"Of 12 claims checked, none were disputed and 1 could not be verified (claim_findings[11], that new vulnerable wallets were still being created in 2026, which none of the fetched sources state), giving about 8% disputed or unverifiable. The core figures hold up against The Hacker News, CVEReports and illbloom.org: the $5.69M lower bound, 2,114 addresses, the May 27 and second-wave drains, and the five wallets with their patch status. The one real discrepancy is the crypto-js 4.0.0 release date (claim_findings[3] and [4]): the page says May 2020 and credits The Hacker News, which says February 2020, while CVEReports says May 1, 2020. The only omission found is minor (the Unlukey checker launch), the subject status does not contradict the page, and no high-priority coverage gap is open.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":7,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 48484fd0-2cc4-419b-8313-5dce45e1715bcopy