CVE-2026-71851 is a wallet generation vulnerability affecting the popular MetaMask application. Our investigation identified wallet addresses derived from recovery phrases generated using a weak implementation of randomness in CryptoJS.
An attacker can use blockchain transaction data to recover the wallet's seed phrase via a brute-force attack. On a standard Nvidia 4090 consumer graphics card, this process takes an average of 9.5 hours.
We have identified several wallet applications—including MetaMask—that used the vulnerable CryptoJS implementation during recovery phrase generation, though other affected wallets may also exist.
Use our tool to check if your seed phrase is susceptible to this vulnerability. To perform the analysis, you need to enter a portion of the seed phrase; this allows us to determine whether it is vulnerable to brute-forcing.