Crypto▼ Bearish
12-Year-Old CryptoJS Bug Drains $5.7M From Web Wallets
A flaw in CryptoJS let hackers guess seed phrases, draining $5.7M from web wallets. Bitcoin holders lost $2.57M. On-chain tracking continues.
Continue with
A vulnerability in the 12-year-old CryptoJS library has led to the theft of $5.7 million from web crypto wallets and mobile applications, according to a market report. The flaw, identified as "Ill Bloom," affected versions 3.x of the JavaScript library. Hackers exploited a weakness in the random number generation function, which did not produce full cryptographic entropy. That reduced the range of mathematical possibilities needed to brute-force 12-word seed phrases.
Under normal conditions, guessing a seed phrase would take billions of years. The flaw meant conventional home computers could crack them in short timeframes, cybersecurity analyses cited in the report said.
The first large wave of thefts hit on May 27. A total of 431 accounts were drained in a single day, with initial losses of $3.14 million. Bitcoin holders took the biggest hit, losing $2.57 million. The rest was spread across Ethereum ($286,000), Rootstock ($177,000), Tron ($81,000), and Polygon ($23,000).