“Ill Bloom”: weak CryptoJS RNG made wallet seed phrases guessable (RRWallet, Milo, Bexo, NanChat, Bitcoin Libre)

What happened

• Drains: about USD 3.14M from 431 accounts on 27 May 2026, about USD 2.55M from 30 May to 13 Jul, and about USD 40K on 20 to 21 Jul. Coinspect’s measured total is USD 5,690,922 to 13 Jul, a lower bound. Advisory GHSA-rg76-677x-56q9 (CVE-2026-71851, CVSS 9.0) published 5 Aug 2026.
• Root cause per the advisory and Coinspect: CryptoJS.lib.WordArray.random() in crypto-js below 4.0.0 used a Multiply-With-Carry generator seeded from Math.random(), cutting 128-bit and 256-bit entropy to about 2^39 and 2^47. It dates to June 2014; 3.2.0 and 3.2.1 used native randomness but 3.3.0 restored the weak code. A React Native bip39 fork (ferrumnet/bip39) swapped upstream’s native randomness for CryptoJS, which is one route into wallets.
• Attribution: none.
• Response: RRWallet and Milo are discontinued with no fix. NanChat fixed in 1.3.0, Bitcoin Libre in v4, Bexo in 20.1.0 (store builds lagging at review). Coinspect runs an address-only checker at illbloom.org.

Sources

• https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9
• https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html
• https://www.coinspect.com/blog/ill-bloom-investigation/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.