Insufficient Entropy in CryptoJS's WordArray.random() Traced to $5M+ in Wallet Drains

What happened

A GitHub Security Advisory (GHSA-rg76-677x-56q9, CVE-2026-71851, CVSS 9.0) confirms that CryptoJS.lib.WordArray.random() in crypto-js versions prior to 4.0.0 is not a cryptographically secure random number generator. The function uses a custom Multiply-With-Carry PRNG seeded from Math.random(), introduced in 3.1.2-4 (2014) and present in nearly every 3.x release. Requests for nominal 128-bit or 256-bit entropy reportedly yield effective search spaces of only about 2^39 and 2^47 possibilities — small enough to brute-force on commodity hardware.

According to the advisory, research firm Coinspect's "Ill Bloom" investigation found that downstream wallet applications used this function as the entropy source for BIP39 recovery phrases, and reproduced the full attack chain from enumerating PRNG outputs to deriving private keys and recovering funds from live addresses.

Why it matters

The advisory states this is exploitable only where an application used the vulnerable function for security-sensitive value generation — merely depending on crypto-js < 4.0.0 is not sufficient on its own. Where it was used for wallet seed generation, the impact is severe and persistent: per the advisory, Coinspect documented coordinated drain waves with a measured lower bound of approximately $5M in stolen assets as of July 13, 2026. Critically, upgrading the library or importing an affected recovery phrase into a new, patched wallet does not remediate anything — the underlying secret itself is weak and must be treated as compromised, not the code path that generated it.

What defenders should do now

• Audit direct, downstream, and transitive dependency trees for crypto-js < 4.0.0, including forks (the advisory names ferrumnet/bip39 as one example).
• Determine whether CryptoJS.lib.WordArray.random() was ever used to generate long-lived secrets — keys, tokens, recovery phrases, session identifiers — not just whether the dependency is present.
• If found, treat any secret produced through that path as compromised regardless of current library version, and plan rotation/migration rather than a simple version bump.
• For user-facing products, communicate clearly that an update alone does not protect previously generated secrets, and that funded wallets need to move to freshly generated recovery phrases.
• Coinspect has published a public address checker at illbloom.org for known exposed-address datasets — advisory text stresses users should submit only public addresses and never enter recovery phrases, private keys, or passwords into any checker.

Developing intel

This is a same-day advisory and the underlying investigation appears ongoing, with the $5M figure described as a measured lower bound rather than a final total. Details on scope, affected downstream products, and additional exposed addresses may continue to emerge. See the original GitHub Security Advisory for full technical details and references: GHSA-rg76-677x-56q9.