A security flaw originating from a legacy JavaScript function has resulted in the loss of $5.7 million in digital assets, according to The Hacker News. Security firm Coinspect identified that the CryptoJS.lib.WordArray.random() function, which has been part of the CryptoJS library for 12 years, provides insufficient entropy for generating secure recovery phrases.
This lack of randomness allowed malicious actors to compromise private keys in five distinct crypto wallet applications. Coinspect researchers conducted an on-chain analysis confirming that the theft occurred across two major sweeps since late May. The firm established a lower bound for the losses at $5.7 million, directly attributing the compromise to the predictable output generated by the flawed library function.
Impacted Data Summary
| Attribute | Detail |
|---|---|
| Vulnerable Component | CryptoJS.lib.WordArray.random() |
| Library Age | 12 years |
| Total Stolen Value | $5.7 million |
| Affected Wallet Apps | 5 |
| Theft Timeline Start | Late May |
Why It Matters
This incident highlights a critical systemic risk in the software supply chain: the reliance on aging, unmaintained cryptographic primitives in modern financial applications. Developers often import mature libraries to save time, yet fail to audit them against modern security requirements. When a core utility like a random number generator—the foundation of all cryptographic security—is found to be defective, it renders the entire security architecture of the wallet effectively obsolete. Moving forward, developers must prioritize the transition to cryptographically secure, standard-compliant APIs such as Web Crypto API, rather than relying on legacy third-party math functions.
Reader Discussion & Insights