A critical flaw in software utilized by at least five cryptocurrency wallet applications rendered certain recovery phrases predictable, enabling attackers to reconstruct them and resulting in at least $5.69 million in traced thefts since May.
Earlier this month, blockchain security firm Coinspect revealed that RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo implemented a weak random-number generator from the CryptoJS library to generate certain crypto wallet recovery phrases.
According to the security firm:
“The vulnerable implementation was introduced in June 2014 as part of an attempt to strengthen WordArray.random() in response to GitHub issue #7, ‘randomBytes is not random enough’, and was implemented in commit ff1f003.”
Malicious actors have exploited this vulnerability across multiple attack campaigns. Coinspect traced approximately $3.14 million drained on May 27 alone, with an additional $2.55 million stolen between May 30 and July 13.
The firm also identified a third attack wave between July 20 and 21, which drained roughly $40,000 from wallets within the Chinese-mnemonic subset.
Cumulatively, the security firm’s analysis encompassed more than 2,000 seeds with activity across Bitcoin, Ethereum, Tron, Rootstock, and Polygon, making the $5.69 million figure a lower bound rather than a measure of total losses.
Additionally, the list of affected crypto wallets may not be exhaustive, as exposure depends on the software version that originally generated the phrase rather than the brand alone.
Weak Randomness Compromised Wallet Key Security
A recovery phrase is the sequence of words that serves as a wallet’s master backup. It can be used to recreate the private keys controlling the wallet, meaning anyone who obtains or reconstructs the phrase can potentially move its funds.
These phrases are designed to be generated from randomness so vast that guessing them is computationally impractical.
Coinspect discovered that the vulnerable CryptoJS.lib.WordArray.random() function reduced the effective search space—which should contain 2^128 or 2^256 possibilities—to approximately 2^39 and 2^47.
This reduction made affected phrases feasible to enumerate, derive into blockchain addresses, and check for funds. Simply having an older CryptoJS dependency does not establish exposure; the vulnerable function had to be specifically used to generate the wallet secret.
This weakness also means that updating an application cannot fix a recovery phrase generated with insufficient randomness. Importing the same phrase into another software or hardware wallet also carries the vulnerability.
Coinspect reported that Bexo resolved the issue in version 20.1.0, NanChat in version 1.3.0, and Bitcoin Libre in version 4. RRWallet and Milo have been discontinued. NanChat separately advised users who created wallets before version 1.3.0 to consider them compromised and to migrate to newly generated phrases.
Coinspect has also released Unlukey, a tool that allows users to check public blockchain addresses against known exposed datasets without submitting private information. A match indicates potential exposure, while a negative result only means the address was not found in the published data.
For users with confirmed affected wallets, the remedy is to generate a new recovery phrase securely and transfer the funds it controls.
Also Read
- USD/BRL Maintains Steady Range Amid Brazil Election Uncertainty and Fed Policy Signals
- Japanese Yen remains fragile ahead of Tokyo CPI, Warsh’s Jackson Hole speech
- Sticky Inflation Drives Dollar Rise as Markets Anticipate Fed Warsh’s Jackson Hole Speech
- Binance Shuffles 3.09 Trillion Shiba Inu as SHIB Exchange Reserves Fall Below 87 Trillion
