On August 6, 2026, RRWallet was exploited via weak key generation on Bitcoin, allowing an attacker to derive private keys and steal approximately $2,000,000. Flagged by Coinspect; no dedicated post-mortem has been published.

Security firm Coinspect disclosed that RRWallet (RenrenBit’s wallet) generated vulnerable seed phrases due to a weak RNG in the CryptoJS library (Ill Bloom vulnerability, CVE-2026-71851), making private keys predictable and leading to theft. One user lost approximately $2 million.