Affected Systems

CryptoJS versions below 4.0.0 (except 3.2.0 and 3.2.1). Five confirmed affected wallet apps: RRWallet (discontinued), Bexo Wallet (fixed in 20.1.0, builds pending), NanChat (fixed in 1.3.0), Bitcoin Libre (fixed in v4, July 2024), and Milo (discontinued). Vulnerability affects applications using CryptoJS.lib.WordArray.random() for generating crypto wallet recovery phrases. Entropy reduced from 2^128/2^256 to 2^39/2^47, enabling brute-force enumeration.

Exploitation Status

Actively exploited. Two confirmed attack waves: May 27 sweep ($3.14M from 431 accounts) and May 30–July 13 sweep ($2.55M from 522 seeds). Total measured theft: $5.69M across Bitcoin, Ethereum, Tron, Rootstock, and Polygon networks. Coinspect describes this as a lower bound; actual victim count estimated in the thousands.

Business Impact

Organizations using affected CryptoJS versions for cryptographic key or seed generation face complete compromise of generated secrets. Recovery phrases remain vulnerable even after app updates or migration to hardware wallets. No CVE assigned yet. GHSA-rg76-677x-56q9 published August 5 with CVSS 9.0 (Critical). The vulnerability existed for 12 years; version 4.0.0 (February 2020) permanently fixed it, but upgrades within 3.x could reintroduce the flaw. Carrying the dependency alone does not guarantee exploitation—only applications using the vulnerable function for security-sensitive values are at risk.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all JavaScript applications and dependencies for CryptoJS versions below 4.0.0; upgrade to 4.0.0 or later immediately if CryptoJS.lib.WordArray.random() is used for cryptographic operations
  • Identify any crypto wallet integrations using RRWallet, Bexo Wallet (pre-20.1.0), NanChat (pre-1.3.0), Bitcoin Libre (pre-v4), or Milo; notify affected users to migrate funds to new wallets with securely generated recovery phrases
  • For NanChat users: upgrade to 1.3.0 and use the built-in migration tool to generate new seeds and transfer funds; for Bexo users: wait for official 20.1.0 release confirmation before migrating
  • Check wallet addresses against Coinspect's public checker (https://coinspect.com or official channels) to determine if funds are at immediate risk; move assets from compromised addresses immediately
  • Review any custom implementations using ferrumnet/bip39 or similar React Native forks that replaced native crypto randomness with CryptoJS; replace with libraries using native cryptographic RNG (e.g., crypto.getRandomValues)

---

# Threat Actor Context

Actor Profile

Ill Bloom is a financially motivated threat campaign targeting cryptocurrency wallet users. Named by blockchain security firm Coinspect in July 2024, the operation exploited a 12-year-old weak random number generator vulnerability (CVE tracked as GHSA-rg76-677x-56q9, CVSS 9.0) in CryptoJS.lib.WordArray.random() to derive recovery phrases from predictable entropy. The actor's motivation is financial theft through systematic enumeration of vulnerable wallet seeds. The campaign demonstrated technical sophistication in identifying the cryptographic weakness, enumerating reduced keyspaces (2^39 for 128-bit, 2^47 for 256-bit instead of intended 2^128/2^256), converting outputs to BIP39 phrases, deriving addresses, and correlating them against public blockchain data to identify funded wallets for draining.

TTPs (Tactics, Techniques, Procedures)

The Ill Bloom campaign leveraged a cryptographic implementation weakness rather than traditional malware. Key techniques include: exploitation of weak cryptographic algorithms (the CryptoJS Multiply-With-Carry generator seeded from Math.random()), brute-force enumeration of reduced entropy spaces to derive recovery phrases, credential harvesting through predictable seed generation, and automated on-chain reconnaissance to identify funded addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon networks. The attack chain involved enumerating generator outputs, converting them to BIP39 mnemonic phrases, deriving cryptocurrency addresses, and querying public blockchain data to locate targets. The operation conducted systematic sweeps rather than opportunistic attacks, indicating organized infrastructure for large-scale enumeration and fund extraction.

Targets & Patterns

Ill Bloom targeted users of five identified cryptocurrency wallet applications: RRWallet (discontinued, no fix), Bexo Wallet (fixed in v20.1.0), NanChat (fixed in v1.3.0), Bitcoin Libre (fixed in v4, July 2024), and Milo (discontinued, no fix). The campaign affected the cryptocurrency and fintech sectors broadly, with victims spanning multiple blockchain networks including Bitcoin, Ethereum, Tron, Rootstock, and Polygon. Coinspect estimated the affected population runs into the thousands across EVM-compatible networks and Bitcoin. Target selection was determined by technical vulnerability rather than geographic or organizational profile—any user who generated a recovery phrase using an affected wallet version between June 2014 and February 2020 (CryptoJS versions below 4.0.0, excluding brief fixes in 3.2.0-3.2.1) was potentially vulnerable. The largest single theft was approximately $2.18 million USDT from one Tron account on July 4, 2024. Victims included 431 accounts in the first sweep and 522 seeds in the second, totaling 2,114 identified seeds across all networks.

Historical Context

The vulnerability exploited by Ill Bloom was introduced to CryptoJS in June 2014 with a Multiply-With-Carry generator seeded from JavaScript's Math.random(). The library briefly fixed the issue in versions 3.2.0 and 3.2.1 by switching to native cryptographic randomness, but version 3.3.0 restored the weak code because the change was considered breaking for the 3.x release line. Version 4.0.0 permanently restored native randomness in February 2020, creating a six-year window of widespread vulnerability. The campaign conducted two documented drain waves: the first on May 27, 2024, stealing approximately $3.14 million from 431 accounts, and a second between May 30 and July 13, 2024, taking $2.55 million from 522 seeds. Coinspect coined the "Ill Bloom" name in July 2024 and identified CryptoJS.lib.WordArray.random() as the root cause in August 2024. The vulnerability was assigned GHSA-rg76-677x-56q9 with a Critical severity rating (CVSS 9.0) on August 5, 2024. Coinspect identified ferrumnet/bip39, a React Native fork that replaced upstream bip39's native cryptographic randomness with CryptoJS, as one integration path into wallet software.

Defensive Recommendations

  • Audit all cryptocurrency wallet implementations for use of CryptoJS versions below 4.0.0 in security-sensitive contexts, particularly recovery phrase generation; upgrade to CryptoJS 4.0.0 or later immediately
  • Implement entropy quality validation for all cryptographic key generation processes; verify that random number generators use native cryptographic APIs (e.g., crypto.getRandomValues() in browsers, crypto.randomBytes() in Node.js) rather than Math.random()
  • Deploy blockchain monitoring to detect abnormal outbound transaction patterns, particularly systematic sweeps of multiple wallets within short timeframes, and alert users to unauthorized fund movements
  • Educate users that upgrading wallet software does not repair existing recovery phrases generated by vulnerable versions; affected users must generate new seeds using patched software and migrate funds immediately
  • Conduct forensic analysis of wallet creation timestamps against vulnerable version release windows (June 2014 - February 2020 for CryptoJS, specific version ranges for affected wallet apps) to identify at-risk user populations for proactive notification