Five point six nine million dollars. That is the confirmed bleed. The real number is higher — it always is. Coinspect tracked the flow across 2,000 seed phrases, five wallet brands, and a five-month attack window. The code was broken. The ledger kept the truth.
This is not a hack. There was no exploit contract, no compromised RPC endpoint, no front-running bot. This was a math failure — an entropy collapse so severe that the theoretical search space of 2^128 collapsed to 2^39. That is not a vulnerability. That is a joke written in JavaScript, deployed in production, and trusted with user funds.
Here is the uncomfortable part: the flaw was introduced in 2014. It sat dormant for a decade. And the wallets that integrated it — Bexo, NanChat, Bitcoin Libre, RRWallet, Milo — never audited the dependency. The code did not lie. It just waited.
When the code bleeds, the ledger keeps the truth.
The Context: A Decade-Old Debt
CryptoJS is one of the most widely used JavaScript cryptography libraries in existence. It has been downloaded tens of millions of times. Its WordArray.random() function was modified in 2014 in response to a GitHub issue — a seemingly innocuous change to address a reported bug. That patch quietly gutted the entropy source.
The result: instead of generating seed phrases with the cryptographic security required by BIP39 — which mandates a cryptographically secure pseudorandom number generator (CSPRNG) — the affected wallets produced seeds with a search space of 2^39 to 2^47. For context, a modern wallet using window.crypto.getRandomValues() operates at 2^128 or 2^256. The difference is not linear. It is exponential. It is the difference between a vault door and a paper screen.
Modern wallets like MetaMask use the Web Crypto API. The affected wallets did not. They relied on a library that had a known, documented flaw for years. The vulnerability was not obscure. It was sitting in plain sight, in the dependency tree, waiting for someone to look.
Coinspect did look. Their analysis spanned more than 2,000 seed phrases across five wallet brands. The attack was automated — enumeration, address derivation, balance checking, and fund sweeps. The window ran from May through July. This was not a smash-and-grab. It was a systematic extraction operation.
Arbitrage is just violence disguised as math. This was the same principle — executed against users instead of markets.
The Core: Breaking Down the Entropy Collapse
Let me be precise about the mechanics, because precision is the only honest currency in this industry.
A BIP39 seed phrase of 12 words carries 128 bits of entropy. A 24-word phrase carries 256 bits. The security model assumes that brute-forcing this space is computationally infeasible. That assumption is the foundation upon which self-custody rests.
The CryptoJS flaw collapsed that foundation. With a search space of 2^39, an attacker with modest GPU resources can enumerate the entire space in days — not centuries. The affected wallets were not generating random seeds. They were generating patterned outputs with severely constrained entropy. Every seed became a lottery ticket, and the attacker held the winning numbers.
The distribution is even more damning. The flaw's impact depended on the software version used at the time of seed generation — not the brand. This means the five wallets identified by Coinspect are almost certainly the tip of the iceberg. Any project that integrated CryptoJS during the affected period and did not subsequently migrate to a modern CSPRNG remains exposed. The exposure is version-dependent, not brand-dependent. That is a supply chain problem with a long tail.
And here is the critical operational detail that most users miss: updating the wallet application fixes only future seed generation. It does nothing for seeds already generated. The weak seeds persist. They are permanent liabilities. If a user imports a weak seed into a hardware wallet or a different software wallet, the vulnerability travels with it. The flaw is embedded in the seed itself, not the application.
This is the "generated is forever" principle. Once a weak seed enters circulation, it is a ticking asset. The attacker knows this. That is why the theft window spanned months — they were running continuous sweeps, harvesting new funds as users imported their old seeds into new wallets, unknowingly carrying the vulnerability with them.
The response from the affected projects tells a story of its own. Bexo, NanChat, and Bitcoin Libre fixed the issue. NanChat went further, proactively notifying users and advising migration. RRWallet and Milo chose a different path: they shut down. That is not a response. That is an exit. When a project abandons its users rather than remediating a known flaw, it is effectively admitting the liability is unmanageable.
Coinspect did what security researchers should do: they published the technical details, released a self-check tool called Unlukey, and gave users a way to determine exposure. That tool is not optional. It is the first step in triage.
The Contrarian Angle: The Blind Spots Nobody Wants to Discuss
Everyone will focus on the five named wallets. That is the comfortable narrative — blame the small players, praise the mainstream, move on. But that framing misses the structural problem.
CryptoJS is everywhere. It is in browser extensions, dApp frontends, trading tools, and internal infrastructure. The specific vulnerable function may not be invoked in all of them, but the library itself is a dependency in thousands of projects. The FUD will not be limited to the five brands. It will spread to any project that has ever touched CryptoJS — justified or not.
The second blind spot is the industry's obsession with brand-name security theater. Users believe that using MetaMask or Ledger makes them safe. That belief is only partially correct. The wallet is only as secure as the seed generation process — and the user's behavior after generation. A weak seed imported into a hardware wallet is still a weak seed. The hardware does not fix the math.
This is the deeper lesson: the industry has spent years building elaborate infrastructure — validators, oracles, bridges, L2s — while the entry point, the seed phrase, remains the weakest link. We audit smart contracts for reentrancy and integer overflow. We stress-test consensus mechanisms. But the random number generator — the single most critical piece of cryptographic infrastructure — is often an afterthought, inherited from a dependency that nobody reads.
My own experience auditing early lending protocols taught me that the whitepaper never tells you where the real risk lives. It lives in the dependencies. It lives in the assumptions. And it lives in the code that nobody bothers to read because it was "well-known" or "widely used." The CryptoJS flaw was documented. The fix was available. The wallets did not check.
There is another uncomfortable truth: the stolen $5.69 million is a floor, not a ceiling. The analysis covered only a subset of seeds and chains. Some of the stolen funds have almost certainly been laundered through mixers or privacy coins by now. The attacker is not sitting on a single address. They are moving through the ecosystem like water through cracks.
The Takeaway: What This Means for Your Positions
The market impact on BTC or ETH is negligible. The affected wallets held a fraction of a percent of total market share. But the operational impact on affected users is total — 100% of their funds, gone, with no recourse.
Here is the actionable checklist, in order of priority:
First, if you have ever used RRWallet, Milo, Bexo, NanChat, or Bitcoin Libre — regardless of when — assume your seed is compromised. Generate a new wallet using a mainstream, audited wallet that leverages the Web Crypto API, and move your funds immediately. Do not import the old seed into the new wallet. That is not migration. That is cross-contamination.
Second, run Coinspect's Unlukey tool against any seed phrases you have stored. If your seed was generated by an affected version of CryptoJS, the tool will identify it. Treat the result as binding.
Third, developers: audit your dependency trees. Not just for known CVEs, but for the quality of the cryptographic primitives you are inheriting. The 2014 CryptoJS patch was not a sophisticated attack. It was a simple flaw that survived a decade because nobody looked.
The black box of third-party code is where the industry's next disaster will come from. The only question is which dependency will fail next.
When the code bleeds, the ledger keeps the truth. The ledger shows $5.69 million and counting. The question now is not whether more seeds will be swept. It is whether the industry will learn the lesson before the next entropy collapse — or after.
