CryptoSlate
A flawed random-number generator in the CryptoJS library left wallet recovery phrases for at least five crypto wallets predictable enough for attackers to reconstruct, contributing to at least $5.69 million in traced thefts since May. Blockchain security firm Coinspect traced three attack waves across the affected wallets, with the largest single-day drain of $3.14 million hitting on May 27. The vulnerability, introduced in June 2014, shrank effective search spaces from a theoretically unbreakable 2^128 or 2^256 down to roughly 2^39 and 2^47, making affected phrases feasible to enumerate, derive into blockchain addresses, and check for funds.
Why it matters
The flaw exposes a category of risk that is unusually hard to undo once it has triggered. A recovery phrase generated with insufficient randomness carries the weakness with it: patching the app does not regenerate the phrase, and importing that phrase into a hardware wallet only relocates the vulnerable secret. NanChat has already told users who created wallets before version 1.3.0 to consider them compromised and migrate to a new phrase. RRWallet and Milo have been discontinued outright, leaving affected users without a direct upgrade path on the original app.
Market impact
The $5.69 million figure is a lower bound rather than a measure of total losses, since Coinspect's analysis covered more than 2,000 seeds with activity across Bitcoin, Ethereum, Tron, Rootstock, and Polygon. The attack also appears ongoing: a third wave between July 20 and 21 drained roughly $40,000 across the Chinese-mnemonic subset. Coinspect has released a tool called Unlukey that lets users check public addresses against known exposed datasets, but a clean result only confirms the address is not in the published set, not that the underlying phrase is safe. For confirmed affected wallets, the remedy is to generate a new recovery phrase from a trusted source and move funds immediately.
Frequently asked questions
-
Which crypto wallets were affected by the predictable seed flaw?
Blockchain security firm Coinspect identified RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo as using the vulnerable CryptoJS.lib.WordArray.random() function to generate some recovery phrases.
-
How much was stolen in the wallet seed phrase attacks?
Coinspect traced at least $5.69 million in thefts across three attack waves since May, with the largest single-day drain of $3.14 million hitting on May 27. The figure is a lower bound, not a total.
-
Why is this wallet vulnerability hard to fix?
A recovery phrase generated with weak randomness carries the flaw with it. Patching the wallet app does not regenerate the phrase, and importing it into a hardware wallet only moves the vulnerable secret to a new location.
-
How much did the weakness reduce the keyspace?
Coinspect found the vulnerable CryptoJS function could reduce effective search spaces expected to contain 2^128 or 2^256 possibilities to roughly 2^39 and 2^47, making affected phrases feasible to enumerate.
-
What can affected wallet users do?
For confirmed affected wallets, the remedy is to generate a new recovery phrase from a trusted source and move the funds it controls. Coinspect's Unlukey tool can check public addresses against known exposed datasets, but a clean result is not a guarantee.
TheBlock
CoinDesk
Crypto Capital Venture
WuBlockchain
Lookonchain