[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuV6oQun0zu23ZlpFYPmIZGIE24XH7joLrc-VUmX6fLc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"de267770-d62e-4a18-bb5f-4514a2d4fad7","decade-old-weak-rng-in-cryptojs-drains-57m-from-crypto-wallets","964564ce-03e4-4ed0-aa6d-c193a5dca4a5","Decade-Old Weak RNG in CryptoJS Drains $5.7M from Crypto Wallets","Five cryptocurrency wallet applications relied on CryptoJS's flawed random number generator to create cryptographic seed phrases, a vulnerability that went undetected and unpatched for over a decade. Because the entropy was insufficiently random, attackers could systematically guess recovery phrases and drain wallets without any direct system access. This incident highlights the danger of blindly trusting third-party cryptographic libraries without ongoing scrutiny of their security properties. Supply chain dependencies—especially in security-critical code paths like key generation—must be continuously evaluated, not simply adopted and forgotten. The $5.7 million loss demonstrates that a single weak link in a cryptographic foundation can silently undermine an entire application's security model.","**Immediate actions:**\n- Audit all cryptographic dependencies for known weaknesses in random number generation and replace any that do not use platform-native CSPRNG (Cryptographically Secure Pseudo-Random Number Generator) sources.\n- Notify affected users immediately and provide clear, step-by-step instructions to migrate funds to wallets with securely generated seed phrases.\n- Scan your software bill of materials (SBOM) for any other use of CryptoJS or similarly deprecated\u002Funmaintained cryptographic libraries.\n\n**Long-term improvements:**\n- Mandate formal cryptographic review of all third-party libraries used in security-critical code paths (key generation, signing, encryption) before adoption and at regular intervals.\n- Maintain a versioned SBOM for every product and integrate automated dependency vulnerability scanning into the CI\u002FCD pipeline.\n- Establish a policy requiring replacement of any cryptographic library that is unmaintained, end-of-life, or flagged by a reputable vulnerability database.\n\n**Detection measures:**\n- Implement continuous monitoring for anomalous transaction patterns (e.g., bulk wallet drains) that may indicate systematic key compromise.\n- Subscribe to security advisories for all open-source dependencies and configure automated alerts when a new CVE affects any library in your stack.\n- Conduct periodic third-party penetration testing specifically targeting cryptographic implementations and key-generation logic.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-218 (SSDF) PW.4: Reuse Existing, Well-Secured Software","NIST SP 800-90A: Recommendation for Random Number Generation Using Deterministic RBGs","NIST CSF ID.SC-3: Supply Chain Risk Management","NIST CSF RS.CO-3: Incident Response Communications","OWASP Cryptographic Failures (A02:2021)","ISO\u002FIEC 27002:2022 Control 8.28: Secure Coding","GDPR Article 32: Security of Processing (appropriate technical measures)",{},"published","2026-08-06T14:21:48.573667+00:00","2026-08-06T14:21:48.464+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fcryptojs-weak-rng-behind-57-million-in.html","cryptojs-weak-rng-behind-5-7-million-in-drains-affects-five-crypto-wallet-apps-4f4e67","CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,54,58],{"slug":34,"name":52,"problem":53},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":55,"name":56,"problem":57},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":59,"name":60,"problem":61},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]