As cited
Copy frozen at (site build).
vulnerabilities
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps
Security researchers identified a weakness in CryptoJS's random number generator function that was used by five cryptocurrency wallet applications to generate recovery phrases, resulting in at least $5.7 million in theft across two incidents since May. The flaw originated from code introduced 12 years ago in the JavaScript cryptography library. Attackers exploited the inadequate entropy to compromise wallet security and drain funds.
Why it matters: Practitioners managing or auditing cryptocurrency wallet implementations, JavaScript dependencies, or crypto libraries must audit code using CryptoJS.lib.WordArray.random() and replace it with cryptographically secure alternatives, as production systems remain exposed to key recovery attacks.
- Source published
- First seen by Cybersecurity Tracker