# crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

CryptoJS WordArray.random() used a Math.random()-seeded MWC PRNG, shrinking 128/256-bit entropy to ~2^39/2^47, letting attackers brute-force BIP39 wallet seeds and drain ~$5M.

- Payout: Research
- Severity: critical
- Program: crypto-js
- Found by: juli
- Disclosed: 2026-08-07
- CVE: CVE-2026-71851
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-rg76-677x-56q9
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-rg76-677x-56q9
- Tags: area:oss domain:oss impact:data-leak impact:funds-loss impact:mass-exploit kind:research platform:ghsa sev:critical tech:nodejs technique:reverse-engineering technique:source-review vuln:crypto

**Target:** CryptoJS.lib.WordArray.random() PRNG in npm crypto-js < 4.0.0
**Root cause:** WordArray.random() used a custom Multiply-With-Carry PRNG seeded from Math.random() instead of a CSPRNG, so nominal 128/256-bit requests yielded only ~2^39/2^47 effective entropy.
**Steps:**
1. Identify apps using `CryptoJS.lib.WordArray.random()` (crypto-js < 4.0.0) as entropy for BIP39 mnemonics.
2. Reimplement the affected `WordArray.random()` MWC behavior.
3. Enumerate feasible PRNG outputs (~2^39/2^47 space).
4. Convert candidate entropy into valid BIP39 recovery phrases.
5. Derive private keys/addresses across derivation paths and networks.
6. Compare derived addresses against public blockchain data and recover keys for funded addresses.
**How found:** Coinspect's Ill Bloom investigation traced downstream wallet apps using the function as BIP39 entropy source, then reasoned the MWC/Math.random seeding collapsed the search space enough to enumerate on commodity hardware.
**Exploitation:** Coinspect enumerated the reduced PRNG output space, converted candidates to BIP39 phrases, derived keys/addresses, matched them against public chain data, and recovered private keys controlling funded addresses; coordinated drain waves stole ~$5M lower bound as of 2026-07-13.
**Escalation:** Persistent exposure: updating the library or re-importing the same phrase does not remediate; future deposits and unmonitored networks/derivation paths remain at risk.
**Insight:** When auditing wallet entropy, don't trust nominal bit counts: check the actual PRNG implementation and seed source, and note that a KDF/hash applied afterward cannot restore missing entropy — enumerate the real output space and match derived addresses against chain data.