Full Report
Coinspect has identified CryptoJS.lib.WordArray.random() as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScript cryptography library 12 years ago, the function supplied weak entropy that affected wallet apps used to generate recovery phrases. Coinspect's on-chain analysis puts the measured theft across two sweeps since late May at a lower bound of
Analysis Summary
# Incident Report: Ill Bloom Wallet Drains (CryptoJS RNG Vulnerability)
## Executive Summary
A critical vulnerability in the `CryptoJS.lib.WordArray.random()` function, introduced 12 years ago, resulted in weak entropy for cryptographic seed generation. This allowed attackers to brute-force recovery phrases for at least five cryptocurrency wallet applications, leading to the theft of approximately $5.7 million. The incident highlights the "Ill Bloom" attack pattern where insufficient randomness makes private keys predictable.
## Incident Details
- **Discovery Date:** July 2024 (by Coinspect)
- **Incident Date:** Late May 2024 – July 2024
- **Affected Organization:** Multiple (RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, Milo)
- **Sector:** Blockchain / Cryptocurrency
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** May 27, 2024 (First detected sweep)
- **Vector:** Exploitation of weak entropy in BIP39 recovery phrases.
- **Details:** Attackers exploited a flaw in the CryptoJS library (v3.x series) where the random number generator relied on `Math.random()` rather than native cryptographic APIs.
### Lateral Movement
- **N/A:** This was a cryptographic attack rather than a network intrusion; attackers moved directly from phrase enumeration to fund extraction.
### Data Exfiltration/Impact
- **May 27, 2024:** $3.14 million drained from 431 accounts.
- **May 30 – July 13, 2024:** $2.55 million drained from 522 seeds (including a $2.18M USDT single-account theft on July 4).
### Detection & Response
- **July 2024:** Coinspect identifies the trend and coins the term "Ill Bloom."
- **August 5, 2024:** CryptoJS maintainer publishes GHSA-rg76-677x-56q9 (CVSS 9.0).
- **August 6, 2024:** Public disclosure of the specific affected wallet applications.
## Attack Methodology
- **Initial Access:** Cryptographic weakness; recovery phrases were generated with low entropy.
- **Persistence:** Not required; once the seed phrase is guessed, the attacker has permanent control of the keys.
- **Defense Evasion:** Use of legitimate BIP39 derivation paths to mask illicit transactions as standard transfers.
- **Credential Access:** Brute-forcing the reduced search space (2^39 or 2^47 instead of the required 2^128 or 2^256).
- **Discovery:** On-chain reconnaissance to identify addresses with balances.
- **Exfiltration:** Automated "sweeping" scripts to transfer funds to attacker-controlled wallets.
- **Impact:** Financial theft and permanent loss of funds.
## Impact Assessment
- **Financial:** Estimated lower bound of $5.7 million in stolen assets.
- **Data Breach:** Compromise of private recovery phrases for over 950 accounts.
- **Operational:** Multiple wallet apps discontinued or forced into emergency patching.
- **Reputational:** Significant damage to the trust in JavaScript-based cryptographic libraries and mobile wallet security.
## Indicators of Compromise
- **Network indicators:** N/A (On-chain transactions are the primary indicators).
- **File indicators:** Dependency on `crypto-js` versions < 4.0.0 (specifically those using `lib.WordArray.random`).
- **Behavioral indicators:** Funds being moved from long-dormant wallets to common "drainer" aggregation addresses.
## Response Actions
- **Containment:** Vulnerable wallet vendors (NanChat, Bitcoin Libre, Bexo) released patches to use secure entropy sources.
- **Eradication:** Advisory issued for users to move funds to entirely new seed phrases generated on secure hardware or updated software.
- **Recovery:** Users must abandon compromised seeds; software updates alone **cannot** fix a phrase that was generated weakly in the past.
## Lessons Learned
- **Dependency Management:** A library update (3.3.0) reverted a security fix, re-introducing a critical vulnerability. Regression testing must include security-critical functions.
- **Entropy Sources:** `Math.random()` is never suitable for cryptographic purposes.
- **Immutability of Compromise:** In crypto-assets, if the *generation* process is flawed, the resulting keys are permanently compromised regardless of later software patches.
## Recommendations
- **For Developers:** Ensure cryptographic libraries utilize `self.crypto.getRandomValues()` or equivalent native OS-level entropy. Avoid using `crypto-js` versions older than 4.0.0 for key generation.
- **For Users:** If using a software wallet generated between 2014 and 2024, verify the source of entropy. When in doubt, migrate funds to a hardware-generated recovery phrase.
- **For Auditors:** Specifically audit the "Initial Entropy" phase of wallet creation, as this is a single point of failure.