A critical vulnerability in a widely-used JavaScript library has left five cryptocurrency wallet apps exposed to potential theft, resulting in an estimated $5.7 million drained from user accounts. The issue lies in CryptoJS’s weak random number generator (RNG), which is used by the affected wallets to securely store and manage users’ cryptographic keys.
The vulnerability allows attackers to predictably guess the seeds used for generating cryptographic keys, effectively allowing them to access and drain funds from affected accounts. This can be achieved through a combination of targeted phishing attacks and sophisticated exploitation of the library’s weaknesses. The impacted wallet apps are likely unaware that their users are at risk, as the issue is largely hidden beneath the surface, requiring advanced technical expertise to identify.
CryptoJS is a popular JavaScript library used for cryptographic operations in web applications, including cryptocurrency wallets. Its RNG is responsible for generating random numbers used in key generation and encryption processes. However, researchers have found that CryptoJS’s RNG can be easily manipulated, allowing attackers to predict the generated keys with high accuracy. This weakness has been exploited in the wild, resulting in significant financial losses.
The affected wallet apps are likely using outdated versions of CryptoJS, which contain the vulnerable RNG implementation. Users are not directly responsible for this issue, as it requires a combination of technical expertise and access to the underlying codebase to exploit. Nevertheless, wallet operators should take immediate action to address this vulnerability by updating their libraries and implementing additional security measures.
The severity of this issue highlights the importance of securing sensitive cryptographic operations in software applications. Developers and users alike must remain vigilant against potential vulnerabilities in widely-used libraries like CryptoJS, as these can have far-reaching consequences when exploited. In light of this incident, wallet operators would do well to conduct thorough security audits and implement robust key management practices to prevent similar incidents in the future.
Users whose accounts are affected by this vulnerability should immediately contact their wallet operator for assistance with recovering their funds. Additionally, all users are advised to remain cautious when using online wallets and services, as even seemingly secure applications can harbor hidden vulnerabilities waiting to be exploited.
Source: The Hacker News — 2026-08-06