$5.7M Crypto Theft Tied to 12-Year-Old Code Bug

CryptoJS shipped bundled inside hundreds of software packages. Wallet developers who incorporated it may not know their code relies on the flawed random number generator. That means the list of affected wallets is likely longer than what has been publicly confirmed.

The first coordinated batch of thefts hit May 27, 2026. In a single day attackers hit 431 accounts and withdrew $3.14 million. Bitcoin holders lost $2.57 million of that. Ethereum addresses lost $286,000, Rootstock $177,000, Tron $81,000 and Polygon $23,000.

Updating the wallet application alone does not fix the problem. A seed phrase generated by the defective system stays vulnerable indefinitely – the math does not change. Experts are urging anyone who used a browser-based wallet or one that relied on CryptoJS to check their public addresses and migrate funds to wallets whose keys were generated outside those affected libraries.

The bigger risk is discovery: with the bug now public and the code path known, attackers can scan for addresses generated by the vulnerable system at scale. The $5.7 million figure represents what has already been taken. It may capture only the first wave of detection.

For more context on the broader crypto security environment, see our crypto market analysis.