A flaw in software used by at least five crypto wallets made some recovery phrases predictable enough for attackers to reconstruct, contributing to at least $5.69 million in traced thefts since May.
Earlier this month, blockchain security firm Coinspect said RRWallet, Bexo Wallet, NanChat, Bitcoin Libre and Milo used a weak random-number generator from the CryptoJS library to create some crypto wallet recovery phrases.
According to the security firm:
“The vulnerable implementation was introduced in June 2014 as part of an attempt to strengthen WordArray.random() in response to GitHub issue #7, “randomBytes is not random enough”, and was implemented in commit ff1f003.”
Malicious attackers have targeted this vulnerability across multiple attack waves, with Coinspect tracing about $3.14 million drained on May 27 and another $2.55 million between May 30 and July 13.
The firm also stated that the attack had a third wave between July 20 and 21, which drained around $40,000 across the Chinese-mnemonic subset.
Cumulatively, the security firm’s analysis covered more than 2,000 seeds with activity across Bitcoin, Ethereum, Tron, Rootstock, and Polygon, making the $5.69 million figure a lower bound rather than a measure of total losses.
Meanwhile, the affected crypto wallets list may not be exhaustive, and exposure depends on the software version that originally generated the phrase rather than the brand alone.
Weak randomness made wallet keys easier to guess
A recovery phrase is the sequence of words that serves as a wallet’s master backup. It can be used to recreate the private keys controlling the wallet, meaning anyone who obtains or reconstructs the phrase can potentially move its funds.
Those phrases are supposed to be generated from randomness so vast that guessing them is computationally impractical.
Coinspect found that the vulnerable CryptoJS.lib.WordArray.random() function could reduce effective search spaces expected to contain 2^128 or 2^256 possibilities to roughly 2^39 and 2^47.
That reduction made affected phrases feasible to enumerate, derive into blockchain addresses, and check for funds. Simply having an older CryptoJS dependency does not establish exposure; the vulnerable function had to be used to generate the wallet secret.
Meanwhile, this weakness also means updating an app cannot fix a recovery phrase generated with insufficient randomness. Importing the same phrase into another software or hardware wallet also carries the vulnerability.
Coinspect said Bexo fixed the generation path in version 20.1.0, NanChat in version 1.3.0, and Bitcoin Libre in version 4. RRWallet and Milo have been discontinued. NanChat separately told users who created wallets before version 1.3.0 to consider them compromised and migrate to a newly generated phrase.
Coinspect has also released Unlukey, which lets users check public blockchain addresses against known exposed datasets without submitting private information. A match indicates potential exposure, while a negative result only means the address was not found in the published data.
For confirmed affected wallets, the remedy is to generate a new recovery phrase securely and move the funds it controls.