Three distinct exploit campaigns in 2026 have drained at least $123 million from cryptocurrency wallets by targeting the same class of vulnerability: non-cryptographic pseudo-random number generators (PRNGs) used to create wallet seeds and private keys. The incidents — the Coldcard firmware bug (...
"The old seed should be treated as compromised." — TRM Labs, analysis of the $116M Coldcard exploit (August 2026)
Three distinct exploit campaigns in 2026 have drained at least $123 million from cryptocurrency wallets by targeting the same class of vulnerability: non-cryptographic pseudo-random number generators (PRNGs) used to create wallet seeds and private keys. The incidents — the Coldcard firmware bug ($116 million, 5,200+ addresses), the CryptoJS "Ill Bloom" flaw ($5.7 million, five wallet apps, 14 chains), and the Qubic network drain ($1.4 million, 1,404 wallets) — share a common failure mode. In each case, wallet software substituted JavaScript's Math.random() or equivalent weak PRNGs where cryptographically secure randomness was required, collapsing key spaces from 128–256 bits to as few as 32–47 bits and making brute-force recovery feasible on ordinary hardware.
The pattern is not new. Unciphered's 2023 "Randstorm" disclosure identified the same class of bug in BitcoinJS wallets generated between 2011 and 2015, potentially affecting $2.1 billion in assets. What has changed is the rate of active exploitation. Before 2026, weak-RNG wallet bugs were primarily theoretical or involved small-scale recovery operations. This year, attackers are systematically sweeping vulnerable addresses at scale.
The economic implications extend beyond direct theft. Every weak-RNG incident forces a chain halt, exchange freeze, or governance intervention — imposing costs on validators, exchanges, and users who had no exposure to the vulnerable software.
| Incident | Date | Amount Stolen | Wallets/Addresses | Root Cause | Recovery Rate | |---|---|---|---|---|---| | Coldcard firmware | July 30–Aug 3 | ~$116M (1,816 BTC) | 5,200+ | Software RNG fallback in firmware 4.0.1+ | Minimal laundering detected | | Ill Bloom (CryptoJS) | May 27 onward | ~$5.7M | Five wallet apps, 14 chains | Math.random()-seeded MWC PRNG | N/A | | Qubic network | Oct 17–18 | ~$1.4M (2.94T QU) | 1,404 | Math.random() seed generation | 87.1% frozen on-chain |
Combined confirmed losses: approximately $123.1 million. All three trace to the substitution of a non-cryptographic PRNG where a cryptographically secure source was required.
JavaScript's Math.random() function implements xorshift128+ in the V8 engine (Chrome, Node.js) and similar algorithms in other environments. Its internal state derives from a single 64-bit OS entropy value. The function is designed for tasks like shuffling arrays or generating game elements. It is not designed for generating private keys.
When wallet developers use Math.random() to produce seed phrases or private keys, the theoretical key space collapses. A 128-bit private key generated via Math.random() effectively carries approximately 32–47 bits of entropy, depending on the implementation and platform. At 2^40 possibilities, an attacker with a consumer GPU can enumerate the full space in hours. At 2^47, a modest cluster finishes in days.
The correct alternative — crypto.getRandomValues() in browsers or the crypto module in Node.js — draws from the operating system's cryptographically secure entropy pool. The API has been available in all major browsers since 2013 and in Node.js since version 0.5.8 (2011). The vulnerable code in each 2026 exploit either predated this API's availability, was written by developers unaware of the distinction, or resulted from configuration errors that bypassed secure paths.
The Coldcard Mk3 and Mk4 hardware wallets are marketed as air-gapped, security-first Bitcoin storage devices. According to TRM Labs, a build configuration error introduced in firmware version 4.0.1 (March 2021) caused seed generation to fall back on a weak software PRNG instead of the device's hardware entropy source.
The effective key strength collapsed from the designed 128 bits to as little as 40 bits on older devices. The bug persisted for over five years before exploitation began on July 30, 2026.
Attackers drained approximately 1,816 BTC — valued at roughly $116 million — from over 5,200 addresses across four waves over four days. TRM Labs noted that transaction patterns differed across waves, suggesting multiple independent actors exploiting the same vulnerability. Laundering remained limited: one Wasabi CoinJoin deposit of 64.9 BTC and a 200 ETH Tornado Cash deposit were the only identified obfuscation attempts.
The remediation is permanent: firmware updates prevent future weak seed generation, but they cannot protect seeds already created with insufficient entropy. According to TRM Labs, users who generated seeds between March 2021 and the patch must generate a new seed on updated hardware and transfer funds. The compromised seed must be treated as permanently exposed.
In July 2026, security firm Coinspect disclosed CVE-2026-71851, a vulnerability in the CryptoJS JavaScript library that they named "Ill Bloom." The flaw affected CryptoJS.lib.WordArray.random(), a function introduced 12 years earlier that used a custom Multiply-With-Carry (MWC) algorithm seeded from Math.random().
The vulnerability reduced 128-bit and 256-bit key spaces to approximately 2^39 and 2^47 possibilities, respectively — small enough to enumerate on consumer hardware. Five wallet applications were confirmed affected: RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo.
Coinspect's on-chain analysis identified thefts totaling at least $5.7 million across two sweeps, with confirmed exploitation beginning May 27, 2026. The drains spanned 14 blockchain networks.
The fix, released in CryptoJS version 4.0.0, replaced the weak PRNG with the platform's native cryptographic API. However, the vulnerable function had been present in the library since at least 2014. Any wallet that generated keys using affected versions of CryptoJS remains exposed regardless of subsequent library updates, because the weak keys themselves — not the software currently in use — are the attack surface.
On October 17–18, 2026, an attacker drained 2.94 trillion QU tokens — valued at approximately $1.4 million — from 1,404 wallets on the Qubic network in roughly 104 minutes (23:42 UTC October 17 to 01:26 UTC October 18).
SlowMist's Security Team published a detailed technical analysis on October 20, identifying two compounding flaws. First, Qubic Wallet generated 55-character lowercase account seeds using Math.random(), character by character. In V8's xorshift128+ implementation, the PRNG's 128-bit state derives from a single 64-bit OS entropy value, reducing the effective search space to approximately 2^32 possibilities.
Second, outputs from the same random stream were exposed in plaintext through a protocol header field called "dejaVu," which the wallet transmitted to network peers. According to SlowMist, with as few as six observed connections, an attacker could reconstruct the PRNG state and recover private keys.
The vulnerability primarily affected seeds generated on iPhones or iPads in any browser before October 18, 2026; on Macs using Safari before the same date; or in the Qubic iOS app before July 2025. These environments provided weaker entropy inputs to Math.random() than Chrome on desktop.
Qubic's network validators (called "Computors") halted the blockchain at tick 85,371,949, freezing 87.1% of stolen funds on-chain. The remaining 12.9% reached the MEXC exchange, where the receiving account was frozen within approximately one hour. Network operators have not yet approved a recovery plan or announced when blockchain operations will resume. Qubic Wallet version 4.26.4 switched new seed creation to crypto.getRandomValues().
Qubic's total market capitalization stood at approximately $62–86 million at the time of the exploit, meaning the $1.4 million drain represented roughly 1.6–2.3% of total network value — a proportionally significant hit for a smaller chain.
The pattern predates 2026. In November 2023, cryptocurrency recovery firm Unciphered publicly disclosed "Randstorm," a collection of bugs in the BitcoinJS library that affected wallets generated between 2011 and 2015. The vulnerability combined weaknesses in the SecureRandom() function from the JSBN JavaScript library with browser-level Math.random() deficiencies of that era.
Unciphered estimated that millions of wallets holding approximately $2.1 billion remained potentially vulnerable. The disclosure established that weak-RNG wallet bugs were an industry-wide pattern, not isolated incidents. The distinction between Randstorm and the 2026 exploits is that the earlier bug primarily represented latent risk, while this year's attacks demonstrate active, systematic exploitation.
Patching the software does not fix the problem. This is the core difficulty of weak-RNG wallet exploits compared to typical software vulnerabilities. A SQL injection can be patched and the system is secure. A weak-RNG wallet key, once generated, is permanently compromised. The entropy deficit is baked into the key itself, not the current state of the software.
Remediation requires users to:
For Coldcard, TRM Labs estimated that 5,200+ addresses generated seeds during the vulnerable window. For Ill Bloom, five wallet apps with unknown total user counts generated keys using the weak PRNG over a period of years. For Qubic, 1,404 wallets were directly affected, but the total population of wallets generated with weak seeds on Apple platforms remains undetermined.
There is no industry-wide registry of which wallet implementations use which random number generators. No standard audit framework mandates specific entropy source verification. The WALLETRADAR research paper (2025) proposed automated detection of randomness vulnerabilities in browser-based cryptocurrency wallets, but adoption remains limited.
$123M+ confirmed stolen in 2026 from three separate weak-RNG exploit campaigns targeting the same fundamental vulnerability class: non-cryptographic PRNGs used for key generation.
The fix is migration, not patching. Software updates prevent future weak key generation but do not secure existing compromised keys. Affected users must generate new seeds and move funds.
Math.random() remains embedded in production wallet code. Despite the availability of crypto.getRandomValues() since 2013, wallet developers continue to ship code that uses non-cryptographic randomness for key generation.
Hardware wallets are not immune. The Coldcard exploit demonstrated that even devices marketed as security-first can fall back on weak software RNG due to build configuration errors.
Smaller chains bear disproportionate impact. The Qubic drain represented 1.6–2.3% of total network value and required a full chain halt. Larger networks absorb similar absolute losses with less systemic disruption.
No industry standard mandates entropy source auditing. Wallet security audits typically focus on smart contract logic, not the randomness quality of key generation. This gap enables the same class of vulnerability to recur across different implementations.
The three weak-RNG exploits of 2026 share a root cause that has been documented since at least 2015: JavaScript's Math.random() and similar non-cryptographic PRNGs produce insufficient entropy for private key generation. The technical fix — using crypto.getRandomValues() or equivalent — has been available for over a decade. The persistence of the vulnerability reflects a gap in development practices and audit coverage, not in available tooling.
Combined confirmed losses of $123 million make weak-RNG exploits one of the costliest vulnerability classes in crypto this year, behind only smart contract exploits in aggregate volume. The Coldcard incident alone ranks among the largest single-vector wallet thefts on record.
For wallet developers, the immediate action is straightforward: audit every code path that generates seeds, keys, or nonces, and verify that each uses a cryptographically secure entropy source. For users, the calculus is harder. Determining whether a wallet's key was generated with adequate randomness requires either developer disclosure or independent audit — neither of which is consistently available.
The economic value at stake is not hypothetical. Randstorm's $2.1 billion exposure estimate from 2023 represents keys that still exist on-chain, potentially vulnerable. The 2026 exploits demonstrate that attackers have moved from theoretical research to systematic, multi-wave extraction campaigns. The window for preemptive migration is closing.