Coinspect has identified CryptoJS.lib.WordArray.random() as the weak random number generator behind the Ill Bloom wallet drains.
Introduced in the JavaScript cryptography library 12 years ago, the function supplied weak entropy that affected wallet apps used to generate recovery phrases. Coinspect’s on-chain analysis puts the measured theft across two sweeps since late May at a lower bound of roughly $5.7 million.
The blockchain security firm, which coined the Ill Bloom name in July, has now confirmed five applications that used the generator as an entropy source for recovery-phrase generation:
- RRWallet, which Coinspect says is discontinued. No fix.
- Bexo Wallet, which Coinspect says has been fixed in version 20.1.0, although the updated builds had not yet been uploaded.
- NanChat, which independently confirmed versions before 1.3.0 were affected. Fixed in 1.3.0.
- Bitcoin Libre, which Coinspect says fixed the issue in version 4, released July 2024.
- Milo, which Coinspect says is discontinued. No fix.
Coinspect told The Hacker News that these are the same five wallets it referenced without naming in July.
The firm said the vendor behind the browser extension mentioned in July told it that the extension had been discontinued and was never widely used. Coinspect cautioned that it cannot confirm it identified every vulnerable wallet. Other affected mobile or browser-extension wallets may also have existed but could not be examined because they had already been removed from app stores or extension marketplaces, or because vendors had replaced them with patched releases and the older vulnerable versions were no longer available.
The public disclosure does not provide complete affected-version ranges for RRWallet, Bexo, Bitcoin Libre, or Milo. Updating the app does not repair an existing phrase.
A recovery phrase generated by an affected version remains guessable wherever it is imported, including into a hardware wallet. Users whose phrases came from an affected path need to create a new one securely and move the funds. Coinspect says hardware-generated seeds and most current software wallets are unaffected.
Coinspect analyzed 128- and 256-bit entropy. Those should yield search spaces of 2^128 and 2^256, but the vulnerable generator reduced them to roughly 2^39 and 2^47, small enough to enumerate on ordinary hardware.
The firm reproduced the attack chain by enumerating outputs, converting them into BIP39 phrases, deriving addresses, and checking them against public blockchain data.
The library fixed this once, then took the fix back out. The Multiply-With-Carry generator, seeded from Math.random(), arrived in June 2014. Releases 3.2.0 and 3.2.1 switched to native cryptographic randomness, but 3.3.0 restored the weak code because the change was considered breaking. An upgrade within 3.x could therefore move a project from a fixed release to a vulnerable one. Version 4.0.0 restored native randomness permanently in February 2020.
Coinspect identified ferrumnet/bip39, a React Native fork that replaced upstream bip39’s native cryptographic randomness with CryptoJS, as one route into wallet software, not the only one.
CryptoJS maintainer Evan Vosberg published GHSA-rg76-677x-56q9 on August 5 with a Critical rating and a CVSS score of 9.0. Its package field lists every release below 4.0.0, despite the 3.2.0 and 3.2.1 exceptions.
The advisory says an application is affected only if it uses the vulnerable function to generate security-sensitive values. Carrying the dependency alone does not satisfy that condition, so the package range is broader than the set of exploitable applications.
Once a recovery phrase has been generated from the function’s output, subsequent hashing or PBKDF2 processing cannot restore the missing entropy, nor can a later package update.
Coinspect says the flaw was exploited in two drain waves. A May 27 sweep took about $3.14 million from 431 accounts. A second run between May 30 and July 13 took $2.55 million from addresses tied to 522 seeds, including roughly 2.18 million USDT from one Tron account on July 4.
The later analysis tracks 2,114 identified seeds and associated addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon. Together, the analyses put measured losses at $5,690,922 through July 13, which Coinspect describes as a lower bound.
Coinspect estimated from blockchain data that the affected population runs into the thousands across Ethereum Virtual Machine (EVM)-compatible networks and Bitcoin, but did not provide a wallet-by-wallet breakdown. As of August 6, NanChat was the only named application found to have published a public advisory.
Coinspect told The Hacker News that Bexo’s 20.1.0 fix is not platform-specific, but that the updated builds had not yet been uploaded. The Hacker News checked Bexo’s official store records on August 6. Apple’s App Store listed version 18.3.5 as the current iPhone release, while Google Play showed an Android update on May 20 but no public version number. Neither listing confirmed that version 20.1.0 was available at the time of review.
Coinspect advised users of wallets that remain active to consult the projects’ official channels for current version and migration guidance. The Hacker News has also contacted Bexo for clarification.
NanChat’s advisory tells users who created a wallet before v1.3.0 to consider it compromised and migrate. Version 1.3.0 includes a tool to generate a new seed and move the funds. Coinspect founder and CEO Juliano Rizzo reported the issue on June 10; the fix shipped two days later.
Coinspect said it withheld the technical details for two months while notifying vendors and searching for exposed addresses.
Coinspect’s public checker accepts wallet addresses, not recovery phrases or private keys. A match means assets tied to the same phrase may be at immediate risk. A negative result only means the address is not in the currently published datasets.
