Exploitation ongoing with high activity in latest observed window (1 mentions)
Immediate actions
Patch affected systems immediately
Assume compromise if assets are exposed
Recommended action window: Immediate (within 24h)
NVD description
crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0.
crypto-js:
* no longer maintained
* history of security weaknesses
Still widely used:
* NPM: ~15k dependents, ~18M weekly downloads
* GitHub: ~2.5k forks, ~1M dependent repositories
The weak PRNG behind Ill Bloom (CVE-2026-71851) was WordArray.random() in versions <4.0.0.
A project is affected if that function was used to generate long-term secrets not simply because crypto-js appears in its dependencies.
Post summary
The text identifies CVE-2026-71851, a weak PRNG vulnerability in crypto‑js WordArray.random() for versions below 4.0.0, noting that projects using that function to generate long‑term secrets are affected.
crypto-js is affected by CVE-2026-71851 (CVSS 9.0 - Critical), a weak random-number generator in affected 3.x releases that can expose keys or wallet seeds. Upgrade to 4.0.0+ and rotate exposed secrets.
Read more: https://ow.ly/XxRE50ZATg7 https://t.co/Ka0X4xQSBL
Post summary
The tweet highlights a critical vulnerability in crypto-js (CVE-2026‑71851) and advises users to upgrade to version 4.0.0+ and rotate secrets as a patch.
@Ledger Can you clarify your historical use of crypto-js in Ledger software in light of GHSA-rg76-677x-56q9 / CVE-2026-71851?
Ledger Live Common previously listed crypto-js as a dependency for the NEO integration.
Did any Ledger software ever call CryptoJS.lib.WordArray.random() for security-sensitive values — including seed entropy, private keys, nonces or key material?
If not, can you confirm which RNG/path was used wherever crypto-js was present?
Post summary
The tweet asks Ledger about the use of CryptoJS in their software and references a CVE, but provides no technical details, PoC, exploit, or mitigation information.
The Ill Bloom wallet-generation vulnerability exposes a security assumption many crypto users rarely question:
A recovery phrase can look completely valid and still have been insecure from the moment it was created.
Ill Bloom, now tracked as CVE-2026-71851, involves weak pseudorandomness inherited through vulnerable CryptoJS code paths.
Certain wallet applications generated BIP39 recovery phrases with dramatically less effective entropy than their nominal security level suggested.
That changes the attack model.
An attacker does not necessarily need:
• A phishing page
• A malicious approval
• Malware
• Access to the victim’s device
• A leaked recovery phrase
If the original seed-generation process is sufficiently predictable, attackers can reproduce candidate recovery phrases offline, derive their associated blockchain addresses, identify funded wallets on public chains, and drain assets.
Researchers estimated effective search spaces of roughly 2^39 possibilities for nominal 128-bit entropy and roughly 2^47 for nominal 256-bit entropy under the vulnerable generation path.
The phrases still looked normal.
They used valid BIP39 words, checksum rules, derivation paths, and ordinary blockchain addresses.
That is why visual inspection cannot identify the weakness.
Confirmed affected applications currently include RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo, although researchers warn that this list may not be exhaustive.
The most important remediation point:
Updating wallet software does not repair an already weak recovery phrase.
Importing that same phrase into MetaMask, Phantom, Ledger, another hardware wallet, or any other wallet does not create new entropy either.
The underlying private keys remain the same.
The proper migration is to generate an entirely new recovery phrase using a trustworthy cryptographically secure generator, then move assets to accounts derived from the new seed.
Also, never enter a recovery phrase into an online vulnerability checker.
Public-address analysis can help investigate transaction history, suspicious counterparties, approvals, asset movements, and compromise indicators, but it cannot determine whether a private recovery phrase was generated with weak entropy.
Our latest research covers the vulnerability, affected wallets, CryptoJS history, attack mechanics, confirmed drain events, migration strategy, address-checker limitations, and the broader supply-chain lesson for wallet developers.
Read the full TokenToolHub analysis:
https://tokentoolhub.com/ill-bloom-wallet-generation-vulnerability/
Post summary
CVE-2026-71851 exposes weak seed generation in multiple wallet apps, leading to real‑world drainage incidents. Users must create a new secure recovery phrase and move funds, as software updates alone do not address the issue.
This post announces a critical RCE vulnerability in crypto-js <4.0.0, explains the weakness, and indicates a patch is now available, with no evidence of a PoC, exploit tool, or active exploitation.
🚨Critical - crypto-js Weak PRNG in WordArray.random() Enables Key/Seed Enumeration (CVE-2026-71851)
crypto-js CryptoJS.lib.WordArray.random() uses a custom Multiply-With-Carry PRNG seeded from Math.random(), yielding ~2^39–2^47 effective entropy for 128/256-bit outputs. Attackers can enumerate generated values to recover downstream BIP39 phrases/private keys and steal funds. Apps using OS CSPRNG APIs instead are not affected.
👉Affected: crypto-js < 4.0.0 | Upgrade to 4.0.0
Post summary
CVE‑2026‑71851 reveals a weak PRNG in crypto‑js WordArray.random(), enabling enumeration of BIP39 seeds; users should upgrade to version 4.0.0 to remediate.
Investigadores de INCIBE han alertado sobre una vulnerabilidad crítica en crypto-js (CVE-2026-71851) que afecta a versiones anteriores a la 4.0.0. Un atacante podría recuperar claves privadas de carteras mediante la función…
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/entropia-insuficiente-en-crypto-js https://t.co/RnSPUtKTDj
Post summary
The text announces a critical vulnerability (CVE-2026-71851) in crypto‑js versions prior to 4.0.0, warning that attackers could retrieve private keys from wallets.
