CryptoJS Wallet Bug "Ill Bloom": Are You Exposed?

Coinspect found five named apps affected: NanChat, Bexo, Bitcoin Libre, RRWallet and Milo. Attackers didn't need to target anyone specifically — they scanned the blockchain for addresses whose keys matched the predictable patterns the weak generator produces, then drained whichever ones held funds. That happened in two identifiable waves: about $3.14 million from 431 accounts around May 27, then another $2.55 million from 522 seeds between May 30 and July 13. This is opportunistic, automated theft, closer to picking locks that were never really locked than to a targeted hack.

The vendor response has been uneven, and that split matters more than the headline dollar figure. Coinspect privately flagged the bug to vendors on June 10, nearly two months before Wednesday's public advisory, and NanChat shipped a fix two days later, on June 12. Bitcoin Libre's fix is already live. Bexo has published a fixed build (20.1.0), though it had not yet reached app stores as of this week — so an update may not yet be available to every affected user. RRWallet and Milo, by contrast, are discontinued apps with no patch coming at all — their users have no official upgrade path, only the option to manually move funds to a new, safely generated wallet.

Coinspect published a checker tool at illbloom.org where users of the five named apps can look up whether their address shows up in the confirmed-drained dataset. It's worth using, but treat a clean result as reassuring, not conclusive. The dataset only reflects addresses that have already been detected and attributed on-chain — it can't tell you whether your specific seed is weak, only whether it has been drained so far. If you used any of these five apps before their patch dates (or at all, in the case of RRWallet and Milo), your wallet's original seed should be treated as potentially compromised regardless of what the checker shows.

This is the question that matters most, and the honest answer is no. Updating to a patched version of one of these apps stops the app from generating new weak seeds going forward — it does nothing to fix a seed that already exists. The randomness problem lives in the moment a wallet is created, not in the app's current code. A seed phrase generated under the old, predictable method is exactly as crackable after the update as it was before. Patching closes the tap; it doesn't drain the puddle already on the floor.

That gap is the real story here. The metric worth tracking isn't how many of the five apps have shipped a fix — it's how many exposed users have actually moved their funds to a freshly generated wallet. That number isn't published anywhere, and there's good reason to think it's low: migrating funds requires a user to understand the distinction between "the app is patched" and "my money is safe," and most people reasonably assume those are the same thing.

For anyone who used one of the five affected apps before its patch date, the only real fix is to generate a brand-new wallet on updated, unaffected software and move funds over — not to keep using the old seed inside a newly updated app. That's true even for NanChat users, whose app is now safe to generate new wallets with; any wallet created before June 12 under the old code still carries the old, weak seed. RRWallet and Milo users face a harder version of the same problem, since there's no official notice telling them to act.

Coinspect's $5.7 million figure will likely keep climbing, not because the bug is spreading to new apps, but because detection lags the actual draining — attackers keep sweeping addresses that were funded before their owners migrated. No additional apps beyond the five have been named, though CryptoJS itself remains unaudited and unmaintained, which means other wallet software built on the same dependency hasn't necessarily been checked. The near-term story to watch isn't a new discovery — it's whether migration among exposed users catches up to the theft before it does.

None of this requires panic if you've never touched these five apps. But if you have, the update notification in your app store is not the finish line — moving your funds to a freshly generated wallet is.