CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps

Summary: Coinspect identified CryptoJS.lib.WordArray.random(), a weak random number generator introduced to the JavaScript library 12 years ago, as the entropy source behind recovery-phrase drains in five crypto wallet apps, with measured theft across two sweeps since late May at a lower bound of roughly $5.7 million. The vulnerable generator reduced 128- and 256-bit entropy to search spaces of roughly 2^39 and 2^47, and releases 3.2.0 and 3.2.1 had switched to native cryptographic randomness before 3.3.0 restored the weak code because the change was considered breaking.
Bottom line: A May 27 sweep took about $3.14 million from 431 accounts and a second run between May 30 and July 13 took $2.55 million from addresses tied to 522 seeds, and updating the app does not repair an existing phrase - a recovery phrase generated by an affected version remains guessable wherever it is imported, including into a hardware wallet.

Read the original at The Hacker News ↗