Weak Random Number Bug in Popular Crypto Library Linked to $5.7 Million in Wallet Thefts

Security firm Coinspect has traced a wave of cryptocurrency wallet drains to a weak random number generator inside CryptoJS, a JavaScript cryptography library used by developers for over a decade. The flawed function, CryptoJS.lib.WordArray.random(), produced insufficiently random values, meaning the 'recovery phrases' it helped generate for at least five crypto wallet apps were far more predictable than intended.

Recovery phrases are meant to be the last line of defence for crypto wallets, giving users a way to restore access if a device is lost. But when the underlying randomness is weak, attackers can potentially guess or reconstruct these phrases and take control of victims' funds. Coinspect's on-chain analysis of the incident, dubbed 'Ill Bloom', found a lower bound of $5.7 million stolen across two separate sweeps since late May, though the true figure could be higher.

This case highlights a growing risk for businesses that build or rely on software using open-source components: a flaw in a single shared library can quietly undermine security across many unrelated products. For Australian small businesses handling digital assets or building applications on third-party code, it's a reminder that the security of your tools is only as strong as their weakest dependency.