Ancient CryptoJS Bug Unleashes $5.7M Heist Across Multiple Blockchain Networks

A dormant security flaw lurking in the CryptoJS JavaScript library has come to light as the culprit behind a coordinated campaign that has drained cryptocurrency holdings from over 2,100 wallets across multiple blockchain networks. The vulnerability, identified as Ill Bloom, exploits a defective random number generation function that rendered seed phrases mathematically predictable—transforming what should be cryptographically unbreakable security into something attackers could compromise using ordinary home computers.

The Hidden Weakness at the Heart of Web Wallets

The CryptoJS library, which has been embedded in countless wallet applications over the years, contained a critical flaw in its versions 3.x (specifically from 3.1.2 onward, excluding versions 3.2.0 and 3.2.1). Rather than generating the true randomness essential for seed phrase security, the library produced predictable combinations of numbers. A typical 12-word seed phrase should require billions of years to crack through brute force. The Ill Bloom vulnerability collapsed that protection by narrowing the possible variants to a range attackers could systematically explore with basic computing hardware.

The problem was compounded by the fact that CryptoJS came packaged within hundreds of other software libraries, creating a cascading effect. Wallet developers who unknowingly incorporated these dependencies found themselves shipping the vulnerability without realizing it. Among the confirmed affected applications are RWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo Wallet—though security researchers warn this list represents only a fraction of potentially compromised services.

Losses Mount Across Multiple Networks

The coordinated theft campaign began on May 27, 2026, when attackers struck 431 accounts in a single day, instantly withdrawing $3.14 million. Bitcoin holders suffered the largest losses at $2.57 million, followed by Ethereum at $286,000, Rootstock at $177,000, Tron at $81,000, and Polygon at $23,000. By August, the confirmed list of compromised applications had grown, and cumulative losses had surpassed $5.7 million.

The scale of the attack reflects how deeply embedded the vulnerable library had become across the ecosystem. Some affected wallet developers have already shut down operations, leaving users without support. Others, including Bitcoin Libre, have backported fixes to earlier versions, while services like NanChat released patches. Bexo Wallet’s update remains pending approval in application stores.

What Users Need to Know

A critical lesson from Ill Bloom: updating a wallet application provides no protection if the underlying seed phrase was generated by the defective system. Once a seed phrase has been compromised mathematically, it remains vulnerable indefinitely. Security experts are urging cryptocurrency holders to audit their public addresses for signs of compromise and, if threatened, to immediately migrate their funds to new wallets with securely generated keys. The broader recommendation is to avoid storing significant cryptocurrency holdings in wallets whose private keys were generated within a web browser environment.

This incident underscores a fundamental risk across all blockchain networks: the security of funds often depends on third-party dependencies developers don’t directly maintain, reminding the community why rigorous code audits and security-first development practices are essential.

Source: U.Today. Not financial advice.