Loss of $5,699,22 Due to Weak Recovery Phrase

Cryptocurrency users have lost at least $5,699,22 due to predictable recovery phrases. The issue lies in the random number generation path used during wallet creation, with CoinSpectre analyzing that a weak random number generation implementation of CryptoJS was used in generating recovery phrases for some software wallets. This vulnerability is tracked as CVE-2026-71851. As of July 13, 2,114 seeds across five networks, including Bitcoin, Ethereum, and Tron, were affected. The first drain occurred on May 27, resulting in approximately $314,968 being siphoned from 431 accounts, while the second drain continued from May 30 to July 13, moving $2,549,954 from 522 seeds. The total loss from the two drains amounted to $5,699,22. The lack of randomness in the recovery phrases has increased the likelihood of attackers gaining access to assets. The affected wallets include RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo, with RRWallet and Milo having discontinued services and thus being unfixable. Inputting existing recovery phrases into other apps is also not a solution. This incident highlights the structural risks that arise when outdated open-source dependencies remain in the wallet creation process.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.