Loading story…
A wallet-drain campaign dubbed Ill Bloom exploited weak entropy in CryptoJS.lib.WordArray.random() to steal at least $5.69 million from cryptocurrency users, according to Coinspect. The flaw affected wallet applications that used vulnerable versions of CryptoJS to generate recovery phrases, allowing attackers to guess seed phrases, derive wallet addresses, and drain funds. Coinspect linked two theft waves between May 27 and July 13 to the issue and identified five affected apps: RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo.
The underlying problem traces to a long-standing weakness in CryptoJS random-number generation, broadly covered by advisory GHSA-rg76-677x-56q9 for versions earlier than 4.0.0, though exploitation depended on whether developers used the function for security-sensitive seed generation. Coinspect warned that simply updating an affected wallet does not secure wallets already created with weak recovery phrases; users must generate a new secure seed phrase and move funds, and additional vulnerable wallet apps may still exist beyond the five publicly named.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
CryptoJS maintainer Evan Vosberg published advisory GHSA-rg76-677x-56q9 with a Critical rating and CVSS score of 9.0, warning that applications are affected if they used the vulnerable function for security-sensitive value generation.
Coinspect said the second wave ran through July 13 and stole $2.55 million in total from addresses tied to 522 seeds.
During the second drain wave, attackers stole about 2.18 million USDT from one Tron account on July 4.
Coinspect said a second Ill Bloom drain wave started on May 30, ultimately stealing funds from addresses tied to 522 seeds through July 13.
Coinspect said the first drain sweep occurred on May 27 and stole about $3.14 million from 431 accounts.
Bitcoin Libre fixed the vulnerable entropy issue in version 4. Coinspect said this release occurred in July 2024.
CryptoJS version 4.0.0 permanently switched back to native cryptographic randomness, removing the weak RNG implementation from the library.
A weak Multiply-With-Carry random-number generator seeded from Math.random() was introduced into CryptoJS, creating the entropy flaw later tied to the Ill Bloom wallet drains.
Coinspect disclosed that the Ill Bloom campaign stemmed from weak entropy in CryptoJS.lib.WordArray.random(), measured at least $5.69 million stolen, and named RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo as affected applications.
After releases 3.2.0 and 3.2.1 had switched to native cryptographic randomness, CryptoJS version 3.3.0 restored the weak random-number code because the earlier change was considered breaking.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcereddit.com
Open sourcecoinspect.com
Open sourceillbloom.org
Open sourceillbloom.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **`CVE-2026-71851`** was disclosed in the JavaScript cryptography library **`crypto-js`**, affecting versions prior to **`4.0.0`**. The flaw lies in **`CryptoJS.lib.WordArray.random()`**, which used a custom Multiply-With-Carry pseudorandom number generator seeded with **`Math.random()`** rather than a cryptographically secure operating-system entropy source. That design sharply reduced the effective entropy of supposedly strong random outputs, making generated keys, initialization vectors, and other secrets potentially predictable or reconstructable. The weakness is especially serious for cryptocurrency wallets and decentralized applications that used the function to generate entropy for **BIP39 recovery phrases**, because attackers may be able to recover private keys and steal funds from affected wallets. Reports assign the issue a **CVSS v3.1 score of 9.0** and map it to **`CWE-331`**, **`CWE-338`**, and **`CWE-334`**. The issue is fixed in **`crypto-js 4.0.0`**, and secure alternatives cited for randomness generation include browser **`window.crypto.getRandomValues()`** and Node.js **`crypto.randomBytes()`**.
Aug 8, 2026
Coinkite disclosed an ongoing security incident in which vulnerable **COLDCARD** firmware generated wallet seeds with weak entropy, allowing attackers to reproduce seeds offline and steal funds. The company said a build and link integration error during its `libNgU` migration caused seed generation to use MicroPython’s non-cryptographic **Yasmarang** PRNG instead of the intended hardware true random number generator, despite `MICROPY_HW_ENABLE_RNG=0` being meant to disable the software path. Coinkite halted shipments, destroyed remaining affected inventory, released patched firmware for newly generated seeds, and warned that seeds already created on vulnerable devices remain at risk; **SATSCARD, OPENDIME, and TAPSIGNER** were not affected. External reporting said the exploitation began rapidly, with Galaxy Research estimating attackers drained **1,367 BTC**—about **$88.6 million**—from **4,385 addresses** across multiple attack waves after an initial 41-minute sweep of 1,082.65 BTC from 1,196 addresses. Coinkite urged users who created seeds on affected firmware without at least **50 independent private dice rolls** and a strong unique **BIP-39 passphrase** to move funds to a new wallet immediately, while preserving affected devices for possible recovery and law-enforcement action. The company also temporarily suspended its normal 120-day customer data blanking process to preserve records for ongoing and anticipated legal proceedings, while allowing customers to request exemption from that retention protocol.
Aug 12, 2026
Researchers identified a **FakeWallet** campaign that placed at least **26 malicious iOS apps** in Apple’s App Store, where they impersonated well-known cryptocurrency wallets including **MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie**. The apps primarily targeted users in **China**, taking advantage of the fact that many legitimate crypto wallet apps were unavailable in the local App Store, and used typosquatting, fake branding, and phishing flows to redirect victims to browser-based credential theft pages or trojanized wallet installers. Investigators said the operation had likely been active since at least late 2025, and Apple was notified and removed several of the identified apps. The malware used multiple techniques to steal wallet secrets from both hot-wallet and cold-wallet companion apps, including **malicious `dylib` injection**, executable hooking, provisioning profiles, and **React Native code tampering**. For hot wallets, the implants scraped mnemonic seed phrases and private keys directly from wallet interfaces; for Ledger-themed variants, the apps displayed convincing in-app prompts and fake verification pages to trick users into entering recovery phrases. Stolen data was **RSA PKCS #1-encrypted**, Base64-encoded, and sent to attacker-controlled servers, and researchers assessed the activity may be linked to the **SparkKitty** threat based on shared modules, Chinese-language artifacts, similar fake App Store-style distribution, and overlapping cryptocurrency theft objectives.
Jun 29, 2026