Fact-check findings

No source the reviewer could reach confirms or contradicts the claim.

1. #13[unverifiable][awaiting moderator]in section: Affected Wallet Applications

   “reports noted that new vulnerable wallets were still being created close to the disclosure in 2026”

   reviewerWallets generated as early as 2018 are vulnerable, and new vulnerable wallets were still being created near the 2026 disclosureNone of the sources I fetched (THN July and August, illbloom.org, CVEReports) state this. I did not fetch crypto.news or the other cited outlets.
   citedcrypto.news/coinspect-warns-ill-bloom-fl…-crypto-wallets/

The cited evidence supports part of the claim but not all of it.

1. #2[partially supported][awaiting moderator]in section: Vulnerability Overview

   “The National Vulnerability Database and CVEReports assigned a CVSS v3.1 base score of 9.0 (Critical), vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.”

   reviewerCVSS 9.0 and CVE-2026-71851 for crypto-jsCVEReports confirms the score and vector. I did not verify that NVD assigned it; THN gives CVSS 9.0 via the GitHub advisory without naming a CVE.
   citedcvereports.com/reports/CVE-2026-71851
2. #4[partially supported][awaiting moderator]in section: Vulnerability Overview

   “A robust fix shipped in version 4.0.0 around May 1, 2020, six years before active exploitation was documented.”

   reviewerRobust fix (4.0.0) shipped around May 1, 2020Sources conflict on the 4.0.0 date (CVEReports May 1, 2020; THN February 2020). I did not check the npm registry, so no correction is proposed.
   citedcvereports.com/reports/CVE-2026-71851
3. #5[partially supported][awaiting moderator]in the timeline

   “crypto-js version 4.0.0 released, restoring native cryptographic randomness and resolving the vulnerability for new users.”

   reviewercrypto-js 4.0.0 released May 2020 (attributed to The Hacker News)The timeline date 2020-05 is attributed to THN, but THN says February 2020. The May date comes from CVEReports, so the attribution is wrong or the date is contested. Same underlying discrepancy as sections[0].
   citedthehackernews.com/2026/08/cryptojs-weak-…-million-in.html
4. #10[partially supported][awaiting moderator]in section: Affected Chains and Scope

   “with Solana also listed in other accounts of the July disclosure”

   reviewerSolana listed among chains in other accounts of the July disclosureSolana is on the illbloom.org chain list. THN does not list it among the loss chains. I did not check the other cited outlets (ForkLog, Cointelegraph).
   citedthehackernews.com/2026/07/attackers-expl…t-ill-bloom.html

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the summary

   “measured at least $5.69 million drained from at least 2,114 vulnerable addresses”

   reviewerCoinspect measured at least $5.69 million drained from at least 2,114 vulnerable addresses (lower bound)Matches The Hacker News August article. Nuance: THN ties the $5.69M to losses through July 13.
   citedthehackernews.com/2026/08/cryptojs-weak-…-million-in.html
2. #3[confirmed][no action needed]in section: Vulnerability Overview

   “The flaw was introduced on June 19, 2014.”

   reviewerFlaw introduced June 19, 2014Consistent across sources.
   citedcvereports.com/reports/CVE-2026-71851
3. #6[confirmed][no action needed]in section: Affected Wallet Applications

   “Bexo Wallet: patch released in version 20.1.0, but as of the August 2026 disclosure updated builds had not yet been uploaded to distribution channels, so users may be running unpatched versions.”

   reviewerFive affected wallets and their patch statusThe wallet table matches THN. Status is as of August 2026 and may have changed.
   citedthehackernews.com/2026/08/cryptojs-weak-…-million-in.html
4. #7[confirmed][no action needed]in section: Exploitation Campaign and Measured Losses

   “Active exploitation began on May 27, 2026, with a coordinated sweep that drained 431 wallet addresses in a single day for approximately $3.14 million ($3,140,968).”

   reviewerMay 27, 2026 sweep of 431 addresses for about $3.14M, Bitcoin about $2.57MSupported. I did not verify the exact $3,140,968 figure or the per-chain breakdown (Ethereum, Rootstock, Tron, Polygon) beyond Bitcoin.
   citedthehackernews.com/2026/07/attackers-expl…t-ill-bloom.html
5. #8[confirmed][no action needed]in section: Exploitation Campaign and Measured Losses

   “A second wave ran from approximately May 30 through July 13, 2026, draining approximately $2.55 million from 522 additional seeds.”

   reviewerSecond wave May 30 to July 13, about $2.55M from 522 seeds; July 4 Tron account lost about $2.18M USDTMatches THN.
   citedthehackernews.com/2026/08/cryptojs-weak-…-million-in.html
6. #9[confirmed][no action needed]in section: Exploitation Campaign and Measured Losses

   “The identified addresses reached a historical peak value of $12.56 million in 2022.”

   reviewerHistorical peak of $12.56M in 2022Supported by the July THN article. The August THN article does not mention it.
   citedthehackernews.com/2026/07/attackers-expl…t-ill-bloom.html
7. #11[confirmed][no action needed]in the timeline

   “On July 20 and 21, 2026, drains targeting Chinese-mnemonic wallets were documented.”

   reviewerDrains targeting Chinese-mnemonic wallets on July 20 and 21, 2026Supported by the project's own site.
   citedillbloom.org/
8. #12[confirmed][no action needed]in section: Technical Root Cause: Entropy Collapse

   “a nominally 128-bit key space collapses to an effective space of approximately 2^39, and a nominally 256-bit key space to approximately 2^47”

   reviewerCoinspect's blog is a source for the root-cause attribution to crypto-js and the 2^39 / 2^47 keyspaceThe 2^39 and 2^47 figures are supported by THN. The Coinspect blog page cited for these claims is only an overview. The claims rest on THN and CVEReports, not on the Coinspect primary technical write-up.
   citedthehackernews.com/2026/08/cryptojs-weak-…-million-in.html