CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps

Coinspect discovered that CryptoJS.lib.WordArray.random() produced far weaker entropy (reducing 128-/256-bit entropy to roughly 2^39–2^47) when used to generate BIP39 recovery phrases, enabling brute-force enumeration and account drains; on-chain analysis attributes at least $5.69M stolen in two waves across Bitcoin, Ethereum, Tron, Rootstock, and Polygon, with five confirmed affected wallets (RRWallet, Bexo, NanChat, Bitcoin Libre, Milo) and varying remediation statuses.