CryptoJS Weak RNG Linked to $5.7M Crypto Wallet Drains

Thu, 06 Aug 2026 13:03:19 +0000

Engineer — Act: Audit any use of CryptoJS.lib.WordArray.random() in your codebase — it provides insufficient entropy for cryptographic key generation; replace with Web Crypto API’s crypto.getRandomValues() immediately and review whether any generated secrets need rotation.
SOC/IR — Learn: Active drains are targeting end-user crypto wallets rather than enterprise estates; no enterprise-relevant IOCs or ATT&CK-mappable TTPs are present, but the weak-RNG exploitation pattern is worth tracking for future detection design.
Leader — Skip

Weak-Rng on CuraSec