A weak random number generator in a popular JavaScript cryptography library has led to the theft of millions of dollars in cryptocurrency. The vulnerability, dubbed Ill Bloom, affects wallet applications that used CryptoJS.lib.WordArray.random() to generate recovery phrases.
Coinspect identified the flaw and has now confirmed five applications that used the generator as an entropy source for recovery-phrase generation. The blockchain security firm's on-chain analysis puts the measured theft across two sweeps since late May at a lower bound of roughly $5.7 million.
The Ill Bloom wallet drain vulnerability represents a significant threat to cryptocurrency users. If your wallet used an affected version to generate your recovery phrase, your funds may be at risk. Let me walk through what happened, which wallets are affected, and what you need to do.
The CryptoJS Weak Random Number Generator
The Ill Bloom wallet drain vulnerability stems from CryptoJS.lib.WordArray.random(). This function was introduced in the JavaScript cryptography library 12 years ago. It supplied weak entropy that affected wallet apps used to generate recovery phrases.
The Multiply-With-Carry generator, seeded from Math.random(), arrived in June 2014. Releases 3.2.0 and 3.2.1 switched to native cryptographic randomness. But 3.3.0 restored the weak code because the change was considered breaking. An upgrade within 3.x could therefore move a project from a fixed release to a vulnerable one. Version 4.0.0 restored native randomness permanently in February 2020.
Coinspect analyzed 128- and 256-bit entropy. Those should yield search spaces of 2^128 and 2^256. But the Ill Bloom wallet drain vulnerability reduced them to roughly 2^39 and 2^47. That is small enough to enumerate on ordinary hardware.
The Affected Wallets
Coinspect has now confirmed five applications that used the vulnerable generator as an entropy source for recovery-phrase generation:
- RRWallet: Discontinued. No fix available.
- Bexo Wallet: Fixed in version 20.1.0, although updated builds had not yet been uploaded as of the report.
- NanChat: Versions before 1.3.0 were affected. Fixed in 1.3.0.
- Bitcoin Libre: Fixed in version 4, released July 2024.
- Milo: Discontinued. No fix available.
Coinspect told The Hacker News that these are the same five wallets it referenced without naming in July. The firm cautioned that it cannot confirm it identified every vulnerable wallet. Other affected mobile or browser-extension wallets may also have existed but could not be examined because they had already been removed from app stores or extension marketplaces.
The Ferrumnet/bip39 Route
Coinspect identified ferrumnet/bip39, a React Native fork that replaced upstream bip39's native cryptographic randomness with CryptoJS, as one route into wallet software. This was not the only route, but it illustrates how the weak random number generator made its way into wallet applications.
The public disclosure does not provide complete affected-version ranges for RRWallet, Bexo, Bitcoin Libre, or Milo. Users of these wallets should consult the projects' official channels for current version and migration guidance.
The Two Drain Waves
The Ill Bloom wallet drain vulnerability was exploited in two drain waves. A May 27 sweep took about $3.14 million from 431 accounts. A second run between May 30 and July 13 took $2.55 million from addresses tied to 522 seeds. This included roughly 2.18 million USDT from one Tron account on July 4.
Coinspect's on-chain analysis puts the measured theft across the two sweeps at a lower bound of approximately $5.7 million. The firm estimates that the affected population runs into the thousands across Ethereum Virtual Machine-compatible networks and Bitcoin.
How the Attack Works
The Ill Bloom wallet drain vulnerability attack chain is straightforward. An attacker enumerates outputs from the weak random number generator, converts them into BIP39 phrases, derives addresses, and checks them against public blockchain data.
Because the entropy is reduced to roughly 2^39 or 2^47, the search space is small enough to enumerate on ordinary hardware. Once an attacker finds a match, they can access the funds in that wallet.
The CryptoJS maintainer published GHSA-rg76-677x-56q9 on August 5 with a Critical rating and a CVSS score of 9.0. Its package field lists every release below 4.0.0, despite the 3.2.0 and 3.2.1 exceptions. The advisory says an application is affected only if it uses the vulnerable function to generate security-sensitive values. Carrying the dependency alone does not satisfy that condition.
What Users Need to Do
The Ill Bloom wallet drain vulnerability requires immediate action from affected users. A recovery phrase generated by an affected version remains guessable wherever it is imported, including into a hardware wallet. Updating the app does not repair an existing phrase.
Users whose phrases came from an affected path need to create a new one securely and move the funds. Coinspect says hardware-generated seeds and most current software wallets are unaffected.
Once a recovery phrase has been generated from the function's output, subsequent hashing or PBKDF2 processing cannot restore the missing entropy. A later package update also cannot fix the problem. The only solution is to generate a new phrase on a secure system and transfer the funds.
NanChat's Response
NanChat was the only named application found to have published a public advisory. The company told users who created a wallet before v1.3.0 to consider it compromised and migrate. Version 1.3.0 includes a tool to generate a new seed and move the funds.
Coinspect founder and CEO Juliano Rizzo reported the issue on June 10. The fix shipped two days later. This rapid response is commendable and should serve as a model for other affected vendors.
The Bexo Situation
Coinspect told The Hacker News that Bexo's 20.1.0 fix is not platform-specific, but that the updated builds had not yet been uploaded. The Hacker News checked Bexo's official store records on August 6. Apple's App Store listed version 18.3.5 as the current iPhone release. Google Play showed an Android update on May 20 but no public version number. Neither listing confirmed that version 20.1.0 was available at the time of review.
Users of Bexo should check the official channels for updates and migration guidance. The Hacker News has contacted Bexo for clarification.
The Broader Impact
The Ill Bloom wallet drain vulnerability is a reminder of the importance of cryptographic randomness in wallet generation. The vulnerability existed in CryptoJS for 12 years. It took a major theft event to bring it to light.
The CryptoJS library is widely used. Any application that used the vulnerable function to generate security-sensitive values could be affected. Coinspect identified five wallets, but there may be others.
The disclosure also highlights the challenge of supply chain security. The CryptoJS fix was reverted in 3.3.0 because the change was considered breaking. This decision prioritized compatibility over security and had serious consequences.
The Ill Bloom Checker
Coinspect's public checker accepts wallet addresses, not recovery phrases or private keys. A match means assets tied to the same phrase may be at immediate risk. A negative result only means the address is not in the currently published datasets.
Users concerned about the Ill Bloom wallet drain vulnerability should check their addresses. If you receive a match, move your funds immediately to a new wallet generated on a secure system.
Wrapping It Up
The Ill Bloom wallet drain is a problem which has cost millions of dollars because of the theft which took place. The random number generator of CryptoJS was not strong enough, and hence entropy was lowered such that the recovery phrases could be predicted.
Five wallets have been identified as affected: RRWallet, Bexo, NanChat, Bitcoin Libre, and Milo. Users of these wallets should check if they are affected and migrate their funds if necessary.
The thefts occurred in two waves in May and July. The total measured loss is at least $5.7 million. The actual number may be higher.
If you generated a recovery phrase using an affected wallet, create a new one securely and move your funds. Do not delay. The attackers are still enumerating and draining wallets.
FAQ Section
What is the Ill Bloom wallet drain vulnerability?
It is a vulnerability where CryptoJS.lib.WordArray.random() generates weak entropy for wallet recovery phrases. The entropy is reduced to roughly 2^39 or 2^47, making it possible to enumerate and guess recovery phrases on ordinary hardware.
Which wallets does the Ill Bloom exploit affect?
The following wallets have been identified: RRWallet (not available anymore), Bexo Wallet (patched in 20.1.0), NanChat (patched in 1.3.0), Bitcoin Libre (patched in version 4), and Milo (not available anymore). There may be other affected wallets too.
How much has been stolen?
Coinspect's on-chain analysis puts the measured theft at a lower bound of approximately $5.7 million across two drain waves in May and July 2026.
What should I do if my wallet is affected?
Create a new recovery phrase securely on a non-affected system and move your funds immediately. Updating the app does not repair an existing phrase. The phrase remains guessable wherever it is imported.
How can I check if I am affected?
Coinspect has published a public checker that accepts wallet addresses. A match means assets tied to the same phrase may be at immediate risk.
