Security firm Coinspect has identified the root cause of a series of cryptocurrency thefts it calls “Ill Bloom”: the CryptoJS.lib.WordArray.random() function, a random number generator baked into a 12-year-old JavaScript cryptography library. Wallet apps that relied on this function to generate recovery phrases produced seeds with far less randomness than the BIP-39 standard requires — low enough that attackers could enumerate the candidate pool offline, derive the matching Bitcoin addresses, and sweep the funds in bulk. Coinspect measured at least $5.7 million taken across two sweeps since late May 2026.
Coinspect has now named five wallet applications that used the flawed generator as an entropy source. RRWallet has been discontinued with no fix; Milo is also discontinued. Bexo Wallet released a patch in version 20.1.0, though the updated builds had not yet been uploaded at the time of disclosure. NanChat confirmed versions before 1.3.0 were affected and patched in 1.3.0. Bitcoin Libre fixed the issue in version 4, released July 2024. Critically, updating the app does not fix an existing seed phrase. Any recovery phrase generated by an affected version of these apps remains guessable regardless of where it is imported — including into a hardware wallet. Affected users must generate a brand-new seed phrase using a safe source of randomness and move all funds to the new wallet.
How to check if you’re affected
Affected versions include NanChat before 1.3.0, Bexo Wallet before 20.1.0, and Bitcoin Libre before version 4. If you ever installed RRWallet or Milo, those apps have no patch — assume any wallet they generated is at risk. To be safe, check when you first created your wallet and whether you used one of these five apps. If you did, generate a completely new seed phrase using a reputable wallet that does not rely on CryptoJS for entropy, then transfer all assets before spending from the old addresses.