Weak CryptoJS Randomness Linked to $5.7M Crypto Wallet Drains

Weak Randomness in Popular Library Exploited

A critical flaw in the widely used CryptoJS JavaScript library has been linked to the theft of $5.7 million from users of five different cryptocurrency wallet applications. The vulnerability stems from the library's weak random number generator (RNG), which allowed attackers to predict or reconstruct private keys and drain funds.

Security researchers who analyzed the incidents say the root cause lies in CryptoJS's reliance on a non-cryptographically secure pseudo-random number generator. When wallet developers used this library to generate keys or seeds, the resulting randomness was insufficient, making wallets vulnerable to brute-force or statistical attacks.

How the Drains Were Carried Out

In each of the five affected apps, attackers were able to derive private keys by exploiting the predictable nature of the generated randomness. The thefts were not isolated to a single platform, suggesting that the issue is systemic among developers who chose convenience over security.

According to the report, the drained funds were moved through multiple addresses and mixers, making recovery difficult. The affected wallet providers have not yet publicly disclosed which specific apps were compromised, nor have they confirmed the exact timeline of the attacks.

Implications for the Crypto Ecosystem

This incident underscores the dangers of using outdated or insecure cryptographic libraries in financial applications. CryptoJS, while popular for its ease of use, has been flagged by security experts for years due to its lack of modern, secure RNG implementations.

For Indian crypto users, the news is a stark reminder to verify the security practices of wallet providers before entrusting them with significant assets. The country's growing crypto adoption makes such vulnerabilities particularly concerning, as regulatory oversight remains fragmented.

What Should Wallet Developers Do?

Experts recommend that developers immediately replace CryptoJS with modern, audited libraries such as Web Crypto API or libsodium, which offer cryptographically secure randomness. Additionally, wallets should implement multi-signature mechanisms and regular security audits to mitigate similar risks.

The affected apps are expected to release patches or guidance for their users in the coming days. However, users who had funds drained may face an uphill battle in recovering their assets, as blockchain transactions are irreversible.

Looking Ahead

As investigations continue, the crypto community will be watching to see if any of the five affected apps come forward with compensation plans or improved security measures. This incident may also prompt regulators to push for stricter security standards in the wallet industry, both in India and globally.