Randstorm / BitcoinJS
Randstorm: the browser flaw behind old Bitcoin wallets
Which software versions are documented, which ones are relevant, and how to abandon an old wallet without retaining its vulnerable private keys.
Contents
What actually went wrong
Randstorm relates to key generation flaws in older browser software. JSBN’s SecureRandom() might combine a weak entropy source with the predictable browser Math.random(). Unciphered revealed this issue on 14 November 2023, identifying vulnerable wallets created between 2011 and 2015. This timeframe reflects observed cases, not a definitive statement about every wallet from those years.
The label SecureRandom does not guarantee security. In Coinpunk’s examined source code, the fallback method fills a 256-byte pool using Math.random(), incorporates the system clock, and feeds an Arcfour generator. A large pool cannot provide unpredictability if its inputs are predictable. The same source also includes stronger Web Crypto and Node.js methods; the critical factor is whether the fallback is actually used.
This is a flaw in the method used to select a private key. It does not compromise Bitcoin’s signature verification process. Opening an old backup in a newer application retains those keys; transferring funds to independently generated keys changes the authorisation for spending.
Wallets, versions and the limits of the evidence
Consider library versions separately from wallet versions. For a hosted website, the code delivered on the day the key was created is more significant than the current app version. The table differentiates between documented incidents and findings from source code analysis.
| Project | Version or period | What this establishes |
|---|---|---|
| BitcoinJS / bitcoinjs-lib | 0.1.3 | Mentioned as an example in the disclosure. JSBN was utilised until March 2014; this does not define a complete range of affected versions for all derivatives. |
| Blockchain.info Blockchain.com | Historical web wallet; no numbered affected range verified | Unciphered’s investigation began with a customer wallet. This does not implicate every Blockchain.com wallet or the current application. |
| bitaddress.org | 2.6.5 · 2.8.0 2013-12-01 · 2014-01-18 | Version 2.6.5 updated JSBN to 1.4. Version 2.8.0 introduced whole-pool Web Crypto initialisation and mandatory mouse/keyboard entropy. These are documented updates, not definitive boundaries proving all earlier versions were vulnerable or all later versions safe. |
| Coinpunk | 0.2.1 63ca325be538 | The inspected repository snapshot identifies itself as version 0.2.1 and includes a Math.random()/Arcfour fallback alongside stronger methods. This is a code-level observation, not evidence that every deployment used the fallback. Development has ceased. |
This summary covers the implementations verified here; it is not an exhaustive list of affected wallets. A product not listed is not necessarily unaffected. An old creation date or an address beginning with 1 is insufficient to identify the key generator.
Prepare the destination once
The three methods below use a new Electrum Desktop wallet as the destination. Menu names correspond to the English 4.8.2 desktop interface reviewed for this article. Download the latest release from the official website; version 4.8.2 serves as a reference for these instructions, not a permanent minimum version.
Hardware wallets we recommend as a new destination →
Electrum — official download and signature checks ↗
- On a trusted, up-to-date computer, download Electrum for your operating system. Follow the official signature verification instructions and independently verify the signer’s fingerprint before installing.
- Select File → New/Restore, name the wallet randstorm-new, then choose Standard wallet → Create a new seed. Write down and confirm the new seed words on paper, then set a password for the wallet file. Do not import the old secret.
- Before depositing, create a separate wallet named recovery-check through File → New/Restore → Standard wallet → I already have a seed. Use only the NEW paper backup. Check that the first receiving address matches in both wallets, using View → Addresses and the Addresses tab. Keep both wallets during this check.
- In randstorm-new, navigate to Receive → Request (choose Onchain if Lightning is enabled). Copy the Bitcoin address. The wallet-specific transfer below must send funds to this address, verifying the fee and full destination before confirming.
Blockchain.info: use the wallet that holds the old addresses
This method applies to a historical Blockchain.info wallet still accessible via Blockchain.com. The current sending instructions describe today’s web interface, not an unverified 2012 interface. A Trading Account balance is a separate product.
- Retain the original encrypted backup and login details. In the web wallet, check Settings → Wallets & Addresses → Bitcoin for any separately imported addresses. Match your known old public addresses to the displayed balances; do not assume a new recovery phrase covers imported keys.
- Open Send in the Wallet dashboard, select Bitcoin, and enter the new Electrum address as the external destination. Begin with a small amount, select Continue, review the address, amount and fee, then click Send.
- Wait for confirmation in Electrum’s History tab. Then transfer the remaining spendable balance, accounting for the fee. Verify each separately funded imported address; a successful test transfer alone does not empty the old wallet. Cease using all deprecated receiving addresses.
bitaddress.org: transfer a paper wallet with Sweep
A bitaddress printout usually represents a single key, not a modern recovery phrase. Preserve the paper and any original HTML file: its filename or footer may identify the release. The version history helps reconstruct the setup; it does not certify an individual key.
- Identify the private key, not the public receiving address. A mainnet WIF commonly starts with 5, K or L; a BIP38-encrypted key starts with 6P. The prefix is only a format hint. Keep the original compression form because it determines the corresponding address.
- For BIP38, first decrypt locally and offline using a verified copy from the official bitaddress repository: Wallet Details → enter the encrypted key → View Details → enter its passphrase → Decrypt BIP38. Compare the resulting address with the paper before taking the matching WIF forward. Never enter the key on a live website or generate a replacement wallet with this old tool.
- In the NEW Electrum destination wallet, open Wallet → Private keys → Sweep. Enter the unencrypted WIF only in this local dialog. Check that the destination belongs to randstorm-new, then review the transaction and fee before broadcasting.
- Sweep transfers the spendable balance controlled by the supplied key in one transaction. It is not an import and not the small-test sequence above. Repeat for other funded paper-wallet keys and retain the originals until all expected receipts are confirmed.
Coinpunk: secure the backup before touching the old server
Coinpunk was self-hosted, so there is no universal current login site or recovery service. These labels come from repository snapshot 63ca325be538, whose package.json declares version 0.2.1. A modified deployment may differ.
- If your original trusted installation still works, open Backup → Download and keep multiple copies of the encrypted wallet. Preserve the login identifier, password and server backup as well. Do not update or reinstall the only surviving instance first.
- The historical Send Bitcoins form contains Bitcoin address to send to, Amount and a displayed fee. Use it only if the original instance still works reliably and supports the destination address. Do not force a bc1 address into this old software; the inspected address parser uses Base58Check.
- For an incompatible destination or an offline server, preserve the backup and recover its keys locally with help that understands this Coinpunk version. The wallet model stores keyPairs, including change keys, inside an encrypted payload. This is not an Electrum seed or a Bitcoin Core wallet.dat; renaming the file cannot convert it.
- Once the recovered WIF keys have been matched to the original addresses, use Electrum’s Sweep procedure above for every funded key. Check the complete set, including change addresses. Keep the encrypted backup and its password until the destination receipts reconcile with the expected balance.
Hardware wallets we recommend as a new destination
For this migration, we recommend Trezor Safe 3 if you prefer physical buttons, or Trezor Safe 5 if a larger touchscreen makes address checks easier for you. Both can keep the new signing keys on a separate device. Buying one does not fix an old key: create a completely new wallet on the device.
The Amazon links open a regional product search, not a verified seller listing. Check the seller against Trezor’s official Amazon storefronts or authorised resellers. Use the device authentication checks during setup; never use a supplied, prewritten wallet backup.
- Start at trezor.io/start and install Trezor Suite. Follow the device-specific setup and authentication checks, choose Create a new wallet and complete the on-device backup check. Keep the backup offline. Do not restore the old wallet or the software-wallet seed from the example above onto this device.
- For a normal send, select the Bitcoin account in Trezor Suite, choose Receive and verify the full address on the connected device. Use this address instead of the software-wallet address in the Blockchain.com route. Check the incoming transfer and its confirmations in Trezor Suite instead of Electrum’s History.
- For the Electrum Sweep route, connect the newly configured Trezor and create an Electrum wallet with File → New/Restore → Standard wallet → Use a hardware device. Follow Trezor’s Electrum guide and use the matching Bitcoin account and address type. Verify a receiving address on the Trezor, then use it as the sweep destination. Enter only the OLD WIF key in Sweep; never type the Trezor backup words into Electrum or a website.
Sources and scope
This case study covers historical browser implementations and their different migration routes. For the wider relationship between entropy, seed phrases and hardware wallets, continue with the background article.
Background: how weak wallet seeds arise →
- Unciphered — Randstorm disclosure, 14 November 2023
- bitaddress.org — signed version history
- Coinpunk — inspected RNG and repository snapshot · package.json · README
- Electrum — recovery, sweeping and privacy FAQ
- Electrum 4.8.2 — desktop wallet wizard · Desktop menus
- Blockchain.com — imported Bitcoin addresses
- bitaddress.org — BIP38 and Wallet Details implementation
- Coinpunk — encrypted wallet model and change keys · Backup · Send
- Trezor Safe 3
- Trezor Safe 5
- Trezor Suite — trezor.io/start
- Trezor — official stores and authorised resellers
- Trezor — migrating from another wallet
- Trezor Suite — receiving and verifying an address
Checked on 19 September 2026 against primary documentation and source code. No real funds or private keys were used in testing. The table is not an exhaustive list or a diagnosis of your wallet.
FAQ
Does BitcoinJS 0.1.3 identify my wallet version?
No. It identifies a library example cited in the Randstorm disclosure. A wallet can bundle or modify that library without exposing its version to the user. The original wallet build and browser environment still need to be identified.
Does bitaddress.org 2.8.0 prove that my paper wallet is safe?
The changelog documents stronger entropy collection in 2.8.0. It does not certify how an individual key was generated, which browser features were available, or whether the file was modified. The article therefore treats it as a documented change, not a universal safety boundary.
Why does the paper-wallet route use Sweep instead of Import?
Import keeps the original private key in use. Sweep creates a transaction that transfers its spendable funds to the prepared destination wallet. The new wallet must have independently generated keys, and the destination and fee must be checked before broadcasting.
Can Electrum open a Coinpunk backup directly?
The inspected Coinpunk version stores an encrypted wallet payload, not an Electrum seed. Preserve the backup, login identifier and password. Recover the keys locally with version-specific expertise, then match them to the original addresses before using the sweep route.