CryptoJS Library Vulnerability Exposed: $5.7 Million Stolen from Wallets

An old vulnerability in the CryptoJS library has been exploited by hackers to drain millions of dollars from cryptocurrency wallets. Over 2,100 addresses across various networks have been affected, with losses exceeding $5.7 million. The issue lies in the random number generation function used in some versions of CryptoJS, which produced predictable patterns instead of completely random numbers.

This flaw allowed attackers to guess wallet recovery phrases using ordinary computers, compromising the security of users' private keys. The problem is not limited to a single wallet or network, as CryptoJS has been used for years as a hidden component in hundreds of software and libraries. Wallet developers may have been unaware of this flaw in their underlying infrastructure.

The first wave of thefts occurred on May 27, 2026, with attackers targeting 431 accounts in one day, extracting approximately $3.14 million in cryptocurrency. Bitcoin accounted for the largest share of this loss, followed by Ethereum and other networks.