How Coinspect traced a wallet-drain investigation back to a twelve-year-old insecure randomness flaw, searched for exposed addresses at scale, and disclosed the findings...

An outdated version of CryptoJS used in wallet applications can generate weak random numbers for BIP39 recovery phrases, potentially allowing attackers to.

A malicious npm package, 'crypto-encrypt-ts,' impersonates CryptoJS to steal crypto wallet data. The malware has been downloaded over 1,600 times.

CryptoJS's weak RNG made recovery phrases guessable across five wallet apps, enabling Ill Bloom thefts totaling at least $5.69 million in two sweeps.

The article shows how APK decompilation with Jadx exposed Cordova JavaScript code, hardcoded database keys, CryptoJS-derived secrets, backend endpoints, and a critical LFI flaw.

This challenge presents a React Native Android application that claims to be a "secure gallery" for storing private images. The application implements several security mechanisms: 6-digit passcode authentication - A numeric PIN required to access the gallery AES-256-CBC encryption - All images are encrypted using the CryptoJS library Hermes bytecode compilation - The JavaScript source code is compiled to Hermes bytecode instead of being shipped as plaintext JavaScript…

ARC Labs recently analyzed a phishing email used in a credential harvesting campaign that leveraged a lure notifying the target they received a voice message and needed to visit a link to access it.

Haz clic para acceder al contenido completo.

Thomas Neil James Shadwell discovered that CryptoJS was using an insecure cryptographic default configuration. A remote attacker could possibly use this issue to expose sensitive information.

Coinspect has identified CryptoJS.lib.WordArray.random() as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScript cryptography library 12 years ago, the function supplied weak entropy that affected wallet apps used to generate recovery phrases. Coinspect's on-chain analysis puts the measured theft across two sweeps since late May at a lower bound of

Sonatype discovered ‘crypto-encrypt-ts’, a malicious npm package impersonating the popular CryptoJS library to steal crypto and personal data.…

An illicit npm package called 'crypto-encrypt-ts' may appear to revive the unmaintained but vastly popular CryptoJS library, but what it actually does is peek into your crypto wallet and exfiltrate your secrets to threat actors.

Coinspect has identified CryptoJS.lib.WordArray.random() as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScript cryptography library 12 years ago, the function supplied weak entropy that affected wallet apps used to generate recovery phrases. Coinspect's on-chain analysis puts the measured theft across two sweeps since late May at a lower bound of

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every …