[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5ORWcIeoaHUeIR53V68ezpx4So8LVDl_WRS7XrJOSKI":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"964564ce-03e4-4ed0-aa6d-c193a5dca4a5","CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps","cryptojs-weak-rng-behind-5-7-million-in-drains-affects-five-crypto-wallet-apps-4f4e67","Coinspect has identified CryptoJS.lib.WordArray.random() as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScript cryptography library 12 years ago, the function supplied weak entropy that affected wallet apps used to generate recovery phrases. Coinspect's on-chain analysis puts the measured theft across two sweeps since late May at a lower bound of","A vulnerability in the CryptoJS JavaScript cryptography library's random number generator, present for over a decade, has been linked to the theft of at least $5.7 million from five cryptocurrency wallet applications. The weak entropy affected the generation of recovery phrases, making them guessable and allowing attackers to drain funds. While some wallets have been fixed, others are discontinued, and users with affected phrases must move their funds to new, securely generated ones.","Weak RNG in CryptoJS library led to $5.7M crypto drain from five wallet apps.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fcryptojs-weak-rng-behind-57-million-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhOLyOOoRbj7XXsr5asbHmKbRetYhjWcAZap4b6VUBQ3ENWpeB46A78vztXFJGUDMDHNskXyUMH6yu9Quv-WLut657FS4Dk4-SICypcAVTLuI7fYUxC7Y4qEUI6A8NMIS-GZ8KkzjRULoNZAPD1TIamWyp-T5vgrjMDQKMD0lmR6pZU8P4VeOwWEo7KxWA\u002Fs1600\u002FCRYPTOJS.jpg","2026-08-06T11:49:48+00:00","2026-08-06T14:00:22.071731+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"CryptoJS","product",{"name":21,"type":19},"RRWallet",{"name":23,"type":19},"Bexo Wallet",{"name":25,"type":19},"NanChat",{"name":27,"type":19},"Bitcoin Libre",{"name":29,"type":19},"Milo","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[],[18,21,23],{"controls":51,"vendors":139},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":82,"name":83,"problem":84,"products":85},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"slug":111,"name":112,"problem":113,"products":114},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":155},"decade-old-weak-rng-in-cryptojs-drains-57m-from-crypto-wallets","Decade-Old Weak RNG in CryptoJS Drains $5.7M from Crypto Wallets","Five cryptocurrency wallet applications relied on CryptoJS's flawed random number generator to create cryptographic seed phrases, a vulnerability that went undetected and unpatched for over a decade. Because the entropy was insufficiently random, attackers could systematically guess recovery phrases and drain wallets without any direct system access. This incident highlights the danger of blindly trusting third-party cryptographic libraries without ongoing scrutiny of their security properties. Supply chain dependencies—especially in security-critical code paths like key generation—must be continuously evaluated, not simply adopted and forgotten. The $5.7 million loss demonstrates that a single weak link in a cryptographic foundation can silently undermine an entire application's security model.",[145,146,147,148,149,150,151,152,153,154],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-218 (SSDF) PW.4: Reuse Existing, Well-Secured Software","NIST SP 800-90A: Recommendation for Random Number Generation Using Deterministic RBGs","NIST CSF ID.SC-3: Supply Chain Risk Management","NIST CSF RS.CO-3: Incident Response Communications","OWASP Cryptographic Failures (A02:2021)","ISO\u002FIEC 27002:2022 Control 8.28: Secure Coding","GDPR Article 32: Security of Processing (appropriate technical measures)",{}]