Ignore the chart. Watch the entropy. Over the past seven days, a quiet but devastating story has been unfolding in the wallets of a few thousand users. It wasn't a smart contract exploit, a governance attack, or a bridge hack. It was something far more fundamental: a weakness in the random number generator (RNG) used to create the very seeds that secure their assets. The result is a confirmed $5.69 million in stolen funds, and the attack is still running.
This is not a new vulnerability. It is a legacy bug, introduced into the popular CryptoJS JavaScript library in 2014 as a fix for a GitHub issue. Eleven years later, it is still bleeding money out of crypto wallets. This is a supply chain failure, a failure of cryptographic pragmatism, and a stark reminder that in this industry, the shortest path to a total loss is rarely a complex exploit. It is usually a failure of the most basic building blocks.
The root cause is precise and damning. The flaw resides in the WordArray.random() function within the CryptoJS library. When a wallet integrated this function to generate the 128 or 256 bits of entropy required for a BIP39 mnemonic, the implementation produced a search space of only 2^39 or 2^47 bits respectively. For context, a proper BIP39 implementation requires a search space of 2^128 or 2^256. The reduction is not a matter of a few decimal points; it is a reduction by a factor of a trillion-trillionth. The theoretical security of a 24-word mnemonic was rendered mathematically trivial to brute-force.
Coinspect, the security firm that discovered the active exploitation, did not stumble upon this by accident. They analyzed over 2,000 compromised seeds and traced them back to a specific set of wallet applications. The affected applications are not household names like MetaMask or Trust Wallet. They are niche products: Bexo, NanChat, Bitcoin Libre, RRWallet, and Milo. This is the first critical detail that most market commentary will miss. The vulnerability is not tied to a specific wallet brand's ambition or code quality, but to their shared dependency on a flawed library. The exposure was determined by the software version in use at the moment of phrase generation, not by the brand on the logo. This means the actual number of affected users is likely far higher than the disclosed list of five applications. If you generated a wallet with any of these apps, or any other app that used this specific function in the CryptoJS library during a specific time window, your seed is compromised.
The mechanics of the attack are as automated as they are chilling. Attackers did not manually target individual victims. They built a system to enumerate the entire reduced search space, derive the corresponding addresses, and check them for balances. Between May and July of 2025, they systematically drained funds from wallets that had been generated with these weak seeds. The automation is the key takeaway here. This is not a targeted heist; it is a passive income stream for the attacker. They are running a continuous sweep of a mathematically finite sandbox.
Now, let's address the narrative that this is a simple fix. It is not. The response from the affected projects highlights a dangerous divergence in operational competence. Bexo, NanChat, and Bitcoin Libre have patched their code to prevent the generation of new weak phrases. NanChat even went so far as to proactively notify users and urge them to migrate. This is the correct, albeit minimum, response. However, RRWallet and Milo have simply shut down operations. This is an abdication of responsibility. For users of those two applications, there is no vendor support. There is only the cold math of their compromised seed.
The most dangerous misconception, however, is that updating the app or migrating to a new wallet solves the problem. It does not. The vulnerability is not in the app's current runtime; it is baked into the entropy of the seed phrase itself. If you generated a seed phrase with a vulnerable version of these apps and then imported that same phrase into a hardware wallet like a Ledger or a Trezor, you have simply moved your compromised key into a more expensive container. The attacker does not care what device you use to sign transactions; they care that your private key exists within their enumerable search space. This is the 'generate once, compromised forever' property of mnemonic generation. The only solution is to generate a brand new seed phrase using a modern, cryptographically secure random number generator like window.crypto.getRandomValues(), and then move your assets to that new address immediately.
Based on my experience auditing whitepapers and infrastructure during the 2017 ICO boom, I can tell you that this pattern is not new. We saw it with the EOS consensus debates and the Tezos governance fights. The market fixates on the narrative of innovation and price action, while the technical foundations crumble. The difference here is that the collapse is not theoretical. It is a direct transfer of wealth from negligent developers to a patient automated thief.
Here is the contrarian angle that the market will ignore: This event is not a death knell for self-custody. It is a death knell for the blind trust in open-source dependencies. The FUD that will emerge from this—the idea that 'self-custody is too dangerous for the average user'—is exactly the wrong lesson to draw. The problem is not the concept of holding your own keys. The problem is the systemic failure of the software supply chain to validate the cryptographic primitives they import. The industry has spent billions on securing smart contract logic, but a single flawed library function in a JavaScript package has rendered the security of five wallets moot. This is an infrastructure failure, not a user failure.
The real narrative shift should be towards 'dependency assurance.' Developers must treat third-party libraries, especially those handling key generation, as critical infrastructure with the same rigor as a consensus layer. The 'move fast and break things' ethos of Web2 cannot survive contact with the irreversible nature of Web3 asset loss. We need a standard that mandates the use of native, platform-level CSPRNGs for seed generation, and we need it now. The CryptoJS library should be considered a legacy, untrusted component for all new projects.
For the users who are still holding assets in addresses generated by these five wallets, the message is simple: do not wait. Do not wait for a statement from the project. Do not wait for a patch. The attacker is running a script that is mathematically guaranteed to find your key eventually. The cost of moving your funds is a few dollars in gas fees. The cost of not moving them is a 100% loss. Bets are cheap; exits are expensive. In this case, the exit is cheap, and the bet is catastrophic. Follow the gas, not the hype. In this case, follow the gas directly to a new, secure address.