Crypto news

Over the past week, the cyber threat landscape has been enriched with several notable incidents: from a large-scale theft of crypto assets due to a vulnerability in old code to a spy campaign targeting hotel guests. I break down the key events that require the attention of every market participant.

Critical vulnerability in a random number generator: $5.7 million theft

Weak entropy in an outdated random number generator caused a series of attacks on cryptocurrency wallet owners. The problem lies in the CryptoJS.lib.WordArray.random() function, written more than a decade ago. When creating seed phrases, it reduced the brute-force space from cryptographically secure 2^128 and 2^256 to a negligible 2^39 and 2^47, allowing attackers to crack keys on ordinary hardware.

The attack, dubbed Ill Bloom, occurred in two waves: on May 27, 431 accounts were drained of $3.14 million, and from May 30 to July 13, another 522 wallets lost $2.55 million. Total damage amounted to about $5.7 million, affecting the Bitcoin, Ethereum, Tron, Rootstock, and Polygon networks. At least five wallets used the vulnerable code, including NanChat and Bitcoin Libre. However, the key conclusion of analysts: updating the application will not save funds, as the compromised seed phrase remains vulnerable forever, even when imported into a hardware wallet.

New macOS stealer: targeted theft instead of full draining

Researchers have discovered an infostealer written in Go that spreads via the ClickFix technique and targets the theft of passwords, Apple Keychain data, and cryptocurrencies. Its main feature is the ability to intercept and modify transactions on the Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple networks right before signing, redirecting only a set percentage of funds to the hacker's address. This approach allows attackers to remain undetected for a long time, parasitizing on victims' accounts. According to experts, the infrastructure is linked to the Russian Aeza Group, previously sanctioned by the US and UK.

Sentence for the creator of Ransom Cartel

The US Department of Justice has sentenced 40-year-old Belarusian citizen Maxim Silnikov, known as J.P. Morgan, for creating and managing the Ransom Cartel ransomware. The project, launched in 2021 under the CaaS model, had significant similarities to the REvil code, indicating Silnikov's possible involvement in the core of the latter. The syndicate attacked at least 18 companies, causing damages exceeding $6.7 million. Silnikov was arrested in Spain, escaped, but was later detained while attempting to cross the Belarusian border. He faces 16 years in prison.

UK police data breach

The ExfilSquad group hacked the Police National Legal Database (PNLD), stealing 1.9 GB of information, including contacts of over 100,000 police officers and 21,000 citizens. The hackers published sample data and are demanding a ransom. Authorities claim that confidential information about victims and witnesses was not stored in the system.

Hotel espionage: the CaptiveCrunch campaign

Microsoft links the large-scale CaptiveCrunch operation to the Russian group Midnight Blizzard (APT29). Hackers compromised Wi-Fi equipment in hotels, replaced DNS, and redirected guests to phishing pages for Microsoft 365 or infected devices via ClickFix. Two new viruses were used: CornFlake (a Go trojan with espionage capabilities) and ChocoShell (a PowerShell stealer operating in memory). Targets included diplomats, top executives, and defense company engineers. The recommendation is simple: treat any public Wi-Fi in hotels as compromised and use a VPN or mobile internet.

My comment: The CryptoJS incident is a wake-up call for the entire industry. It shows that even "impenetrable" cryptographic algorithms can be nullified due to implementation errors made years ago. Users who created wallets during that period should immediately migrate to new addresses, without relying on software updates. As for the macOS stealer, its selective approach to theft is an evolution toward more covert and persistent attacks, making the detection of such threats a critical security task.