Five wallets made recovery phrases a computer could guess — and an app update cannot undo it

At least 5.69 million dollars has been drained from crypto wallets whose recovery phrases were never random enough to be safe, according to the security firm Coinspect, which traced the thefts to a weak random-number generator that five wallet apps used to create some of those phrases. The awkward part is that the weakness lives in the phrase itself, so updating the app does not repair a wallet that already exists.

Coinspect named RRWallet, Bexo Wallet, NanChat, Bitcoin Libre and Milo as apps that generated some recovery phrases using a flawed function from the CryptoJS library. The vulnerable code was added back in June 2014, ironically as an attempt to strengthen the library's randomness. Coinspect cautions that the list may not be exhaustive, and that exposure depends on the software version that originally created your phrase rather than on the brand name alone.

A recovery phrase is the sequence of words that acts as a wallet's master backup: anyone who has it, or can reconstruct it, can move the money. Its whole defence is that it was picked from a pool of possibilities so vast that guessing is hopeless. Coinspect found the flawed function shrank search spaces meant to hold 2^128 or 2^256 possibilities down to roughly 2^39 and 2^47 — small enough for an attacker to simply run through them, turn each candidate into blockchain addresses and check which ones hold funds. That is what happened, in waves: about 3.14 million dollars on May 27, another 2.55 million between May 30 and July 13, and roughly 40,000 dollars on July 20 and 21 against the subset of phrases generated in Chinese wordlists. The analysis covered more than 2,000 seeds with activity on Bitcoin, Ethereum, Tron, Rootstock and Polygon, which makes the total a floor rather than a final count.

The apps have since fixed how new phrases are generated — Bexo in version 20.1.0, NanChat in 1.3.0, Bitcoin Libre in version 4 — while RRWallet and Milo have been discontinued. None of that helps a phrase that was already created with the broken generator, and importing that phrase into a different app, or even into a hardware wallet, carries the weakness along with it. NanChat told users who made wallets before 1.3.0 to treat them as compromised and migrate to a newly generated phrase. Coinspect has published a checking tool called Unlukey that compares public blockchain addresses against its dataset of exposed ones without asking for anything private; a match signals likely exposure, while no match only means your address was not in the published data.

The lesson generalises beyond these five apps: a recovery phrase is only as strong as the software and the device that produced it. Favour wallets with a public security track record, generate the phrase on a device you trust, and if you have real doubt about where an old phrase came from, the only genuine remedy is to create a fresh wallet and move the funds to it. And whatever a support agent or a website tells you, never type your recovery phrase anywhere to have it checked — legitimate tools only ever need your public address.