Weak CryptoJS random-number generator led to $5.7 million in cryptocurrency losses

Coinspect identified CryptoJS.lib.WordArray.random() as a weak random-number generator affecting wallet applications that used it to generate recovery phrases. Measured losses from two drain waves reached at least $5,690,922 by July 13.