TLDR
A long-hidden bug in the CryptoJS library let attackers brute-force wallet seed phrases, stealing about $5.7 million in crypto from more than 2,100 web-based wallets.
- The Ill Bloom exploit abused a 12 year old random number bug in CryptoJS, making 12 word seed phrases far easier to guess and drain.
- Victims span Bitcoin (BTC), Ethereum (ETH) and other chains, and simply updating wallet apps cannot secure funds created with vulnerable seeds.
- The incident highlights that third party cryptography libraries are a systemic risk and that users should periodically re evaluate how their wallets generate randomness.
Deep Dive
1. Ill Bloom Exploit Mechanics
Reports describe a flaw in CryptoJS 3.x (except 3.2.0 and 3.2.1) where the random number generator produced predictable outputs, drastically reducing the randomness in BIP 39 style 12 word seed phrases.
Attackers used this to brute-force seeds in a coordinated campaign dubbed the Ill Bloom exploit, draining over $5.7 million from more than 2,100 wallets across Bitcoin, Ethereum, Rootstock, Tron and Polygon according to detailed coverage of the incident.
The first major theft wave on 27 May 2026 hit 431 accounts in a single day, with around $3.14 million stolen and Bitcoin users suffering the largest share of losses.
2. Affected Wallets And Why Patches Arent Enough
The vulnerable CryptoJS code was embedded in multiple web and mobile wallets, including RWallet (RRWallet), Bexo Wallet, NanChat, Bitcoin Libre and Milo Wallet, which collectively account for the documented losses. Some, like Milo and RWallet, have shut down, leaving users without support.
Crucially, updating these apps or libraries does not fix seeds that were originally generated while the bug was present. Those seed phrases are permanently compromised because an attacker can continue to reproduce them and sweep funds, even on a patched app.
Security researchers advise checking whether your wallet ever relied on the affected CryptoJS versions and, if it did, creating a brand new wallet with a fresh seed generated by a well audited implementation rather than continuing to use the old seed.
If a wallet you used was built on the vulnerable CryptoJS versions, treating that old seed as unsafe and moving long term holdings to a new, securely generated seed can materially reduce ongoing risk.
3. Bigger Lessons For Wallet Security
This exploit sits alongside other recent entropy bugs, such as the Coldcard hardware wallet flaw that allowed attackers to reconstruct seeds by exploiting low randomness, showing that self custody tooling is not automatically safe.
The common theme is weak or opaque randomness. When wallets rely on third party libraries or software pseudo random generators without rigorous testing, many users can be exposed at once, even years after code was written.
Practical responses include favoring wallets that clearly document how they generate entropy, watching for vendor security disclosures, and avoiding browser generated keys for large balances in favor of more verifiable methods like robust hardware RNGs or carefully implemented physical dice entropy.
Confidence: high because multiple independent news and research reports provide consistent technical details and loss estimates for the CryptoJS Ill Bloom exploit.
Conclusion
A single bug in a widely used CryptoJS library turned thousands of web wallets into easy targets, draining $5.7 million and proving that core randomness routines are a critical failure point in crypto security.
For everyday users, the key takeaway is that wallet choice and seed generation method are as important as the network or coin you hold, and that periodically migrating away from older or poorly documented setups can be a sensible part of long term self custody hygiene.
CoinsKid.Com