CryptoJS vulnerability allows prediction of wallet seeds, resulting in $5.69 million in losses

Blockchain security firm Coinspect has announced that at least five cryptocurrency wallet apps used a vulnerable random number generator in the CryptoJS library to generate recovery phrases (seed phrases), allowing attackers to trace and steal a minimum of $5.69 million. This figure represents a lower bound based on tracked cases, and the actual damage may be significantly higher. The vulnerability was introduced in commit ff1f003 during an attempt to improve the WordArray.random() function in the CryptoJS library in June 2014. This implementation drastically reduced the possible search space for recovery phrases, which should theoretically be 2^128 or 2^256, to approximately 2^39 to 2^47. With this reduced scope, it becomes practically feasible for attackers to enumerate possible phrases, derive blockchain addresses, and verify balances. The attacks occurred in multiple waves. According to Coinspect, approximately $3.14 million was stolen on May 27th, and another $2.55 million was stolen between May 30th and July 13th. Additionally, approximately $40,000 was stolen from a Chinese mnemonic subset between July 20th and 21st. The analysis covered over 2,000 seeds across five networks: Bitcoin, Ethereum, Tron, Rootstock, and Polygon. The affected apps are RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo. RRWallet and Milo have already ceased operations. Bexo patched the vulnerable random number generation path in version 20.1.0, NanChat in version 1.3.0, and Bitcoin Libre in version 4. NanChat has separately notified users who created wallets before version 1.3.0 to consider those wallets compromised and to migrate to a new wallet with a newly generated recovery phrase. A crucial point to note is that recovery phrases generated using this vulnerable method cannot be resolved by simply updating the app or importing the same phrase into a different software or hardware wallet. This is because the vulnerability lies in the software version used when the phrase was initially generated, not in the app itself. Coinspect has released a tool called "Unlukey" that allows users to check if their address is included in the known compromised dataset. They emphasize that the only solution for confirmed victims is to securely generate a new recovery phrase and transfer their funds.