Executive brief
A popular JavaScript library used for cryptography contains a flaw in how it generates random numbers. This weakness makes it possible for attackers to guess security-sensitive values, such as recovery phrases for cryptocurrency wallets. In practice, this has already led to the theft of millions of dollars in digital assets because the 'random' keys were not sufficiently unpredictable.
Technical details
The vulnerability exists in the `CryptoJS.lib.WordArray.random()` function, which used a custom Multiply-With-Carry PRNG seeded by the non-cryptographic `Math.random()`. This implementation results in significantly reduced entropy; for example, a requested 256-bit value may only have an effective search space of 2^47, which is susceptible to brute-force enumeration on modern hardware. Attackers can exploit this to recover BIP39 recovery phrases and private keys in downstream applications like crypto wallets. The issue was resolved in version 4.0.0 by migrating to native platform cryptographic APIs (Web Crypto API or Node.js crypto module). Note that rotating the library does not fix previously generated secrets, which must be manually replaced.
Affected products
- brix crypto-js < 4.0.0
Timeline
- 2026-08-05: disclosed: Initial disclosure by Coinspect
- 2026-08-07: advisory: GitHub Advisory published
- 2020-05-20: patched: Version 4.0.0 released (historical context)