Randstorm / BitcoinJS
Randstorm: the browser flaw behind old Bitcoin wallets
Which software is documented, which versions matter, and how to leave an old wallet without carrying its vulnerable keys with you.
Table of Content
What actually went wrong
Randstorm concerns key generation in older browser software. JSBN’s SecureRandom() could combine an inadequate entropy source with a predictable browser Math.random(). Unciphered disclosed the issue on 14 November 2023 and reported vulnerable wallets created in 2011–2015. That is an observed period, not a verdict on every wallet from those years.
The name SecureRandom is not a security guarantee. In Coinpunk’s inspected source, the fallback fills a 256-byte pool using Math.random(), mixes in the clock and feeds an Arcfour generator. A large pool cannot supply unpredictability that its inputs lack. The same source also contains stronger Web Crypto and Node.js paths: reaching the fallback is the important distinction.
This is a defect in the way a private key was chosen. It is not a break of Bitcoin’s signature verification. Opening an old backup in a newer app preserves those keys; moving funds to independently generated keys changes what authorizes spending.
Wallets, versions and the limits of the evidence
Read a library version separately from a wallet version. For a hosted website, the code served on the day of key creation matters more than today’s app version. The table distinguishes a documented incident from source-code findings.
| Project | Version or period | What this establishes |
|---|---|---|
| BitcoinJS / bitcoinjs-lib | 0.1.3 | Named as an example in the disclosure. JSBN was used until March 2014; this does not establish a complete affected-version range for every derivative. |
| Blockchain.info Blockchain.com | Historical web wallet; no numbered affected range verified | A customer wallet was the starting point of Unciphered’s investigation. This does not implicate every Blockchain.com wallet or the current app. |
| bitaddress.org | 2.6.5 · 2.8.0 2013-12-01 · 2014-01-18 | 2.6.5 updated JSBN to 1.4. 2.8.0 added whole-pool Web Crypto initialization and mandatory mouse/keyboard entropy. These are documented changes, not a proven “all earlier versions vulnerable / all later versions safe” boundary. |
| Coinpunk | 0.2.1 63ca325be538 | The inspected repository snapshot labels itself 0.2.1 and contains a Math.random()/Arcfour fallback alongside stronger paths. This is a code finding, not proof that every deployment used the fallback. Development has stopped. |
This overview covers the implementations verified here; it is not an exhaustive affected-wallet list. An unlisted product is not automatically unaffected. An old creation date or an address starting with 1 is not enough to identify the generator.
Prepare the destination once
The three routes below use a new Electrum Desktop wallet as the destination. Menu names refer to the English 4.8.2 desktop interface checked for this article. Download the current release from the official site; 4.8.2 is a reference for the instructions, not a permanent minimum version.
Hardware wallets we recommend as a new destination →
Electrum — official download and signature checks ↗
- On a trusted, updated computer, download Electrum for your operating system. Follow the official signature instructions and independently check the signer fingerprint before installation.
- Choose File → New/Restore, name the wallet randstorm-new, then select Standard wallet → Create a new seed. Record and confirm the new words on paper and set a wallet-file password. Do not import the old secret.
- Before depositing, create recovery-check with File → New/Restore → Standard wallet → I already have a seed, using only the NEW paper backup. Compare the first receiving address in both wallets via View → Addresses and the Addresses tab. Keep both wallets during this check.
- In randstorm-new, use Receive → Request (Onchain if Lightning is enabled). Copy the Bitcoin address. The wallet-specific route below must send to this address, with the fee and full destination checked before approval.
Blockchain.info: use the wallet that holds the old addresses
This route is for a historical Blockchain.info wallet you can still access through Blockchain.com. The current send instructions describe today’s web interface, not an unverified 2012 screen. A Trading Account balance is a different product.
- Keep the original encrypted backup and login records. In the web wallet, check Settings → Wallets & Addresses → Bitcoin for separately imported addresses. Match your known old public addresses to the displayed holdings; a new recovery phrase must not be assumed to cover imported keys.
- Open Send in the Wallet dashboard, select Bitcoin and enter the new Electrum address as the external destination. Start with a small amount, choose Continue, review the address, amount and fee, then Send.
- Wait for confirmation in Electrum’s History. Then send the remaining spendable balance, accounting for the fee. Check each separately funded imported address; the successful test alone does not empty the old wallet. Stop using all retired receiving addresses.
bitaddress.org: transfer a paper wallet with Sweep
A bitaddress printout usually represents a single key, not a modern recovery phrase. Preserve the paper and any original HTML file: its filename or footer may identify the release. The version history helps reconstruct the setup; it does not certify an individual key.
- Identify the private key, not the public receiving address. A mainnet WIF commonly starts with 5, K or L; a BIP38-encrypted key starts with 6P. The prefix is only a format hint. Keep the original compression form because it determines the corresponding address.
- For BIP38, first decrypt locally and offline using a verified copy from the official bitaddress repository: Wallet Details → enter the encrypted key → View Details → enter its passphrase → Decrypt BIP38. Compare the resulting address with the paper before taking the matching WIF forward. Never enter the key on a live website or generate a replacement wallet with this old tool.
- In the NEW Electrum destination wallet, open Wallet → Private keys → Sweep. Enter the unencrypted WIF only in this local dialog. Check that the destination belongs to randstorm-new, then review the transaction and fee before broadcasting.
- Sweep transfers the spendable balance controlled by the supplied key in one transaction. It is not an import and not the small-test sequence above. Repeat for other funded paper-wallet keys and retain the originals until all expected receipts are confirmed.
Coinpunk: secure the backup before touching the old server
Coinpunk was self-hosted, so there is no universal current login site or recovery service. These labels come from repository snapshot 63ca325be538, whose package.json declares version 0.2.1. A modified deployment may differ.
- If your original trusted installation still works, open Backup → Download and keep multiple copies of the encrypted wallet. Preserve the login identifier, password and server backup as well. Do not update or reinstall the only surviving instance first.
- The historical Send Bitcoins form contains Bitcoin address to send to, Amount and a displayed fee. Use it only if the original instance still works reliably and supports the destination address. Do not force a bc1 address into this old software; the inspected address parser uses Base58Check.
- For an incompatible destination or an offline server, preserve the backup and recover its keys locally with help that understands this Coinpunk version. The wallet model stores keyPairs, including change keys, inside an encrypted payload. This is not an Electrum seed or a Bitcoin Core wallet.dat; renaming the file cannot convert it.
- Once the recovered WIF keys have been matched to the original addresses, use Electrum’s Sweep procedure above for every funded key. Check the complete set, including change addresses. Keep the encrypted backup and its password until the destination receipts reconcile with the expected balance.
Hardware wallets we recommend as a new destination
For this migration, we recommend Trezor Safe 3 if you prefer physical buttons, or Trezor Safe 5 if a larger touchscreen makes address checks easier for you. Both can keep the new signing keys on a separate device. Buying one does not fix an old key: create a completely new wallet on the device.
The Amazon links open a regional product search, not a verified seller listing. Check the seller against Trezor’s official Amazon storefronts or authorised resellers. Use the device authentication checks during setup; never use a supplied, prewritten wallet backup.
- Start at trezor.io/start and install Trezor Suite. Follow the device-specific setup and authentication checks, choose Create a new wallet and complete the on-device backup check. Keep the backup offline. Do not restore the old wallet or the software-wallet seed from the example above onto this device.
- For a normal send, select the Bitcoin account in Trezor Suite, choose Receive and verify the full address on the connected device. Use this address instead of the software-wallet address in the Blockchain.com route. Check the incoming transfer and its confirmations in Trezor Suite instead of Electrum’s History.
- For the Electrum Sweep route, connect the newly configured Trezor and create an Electrum wallet with File → New/Restore → Standard wallet → Use a hardware device. Follow Trezor’s Electrum guide and use the matching Bitcoin account and address type. Verify a receiving address on the Trezor, then use it as the sweep destination. Enter only the OLD WIF key in Sweep; never type the Trezor backup words into Electrum or a website.
Sources and scope
This case study covers historical browser implementations and their different migration routes. For the wider relationship between entropy, seed phrases and hardware wallets, continue with the background article.
Background: how weak wallet seeds arise →
- Unciphered — Randstorm disclosure, 14 November 2023
- bitaddress.org — signed version history
- Coinpunk — inspected RNG and repository snapshot · package.json · README
- Electrum — recovery, sweeping and privacy FAQ
- Electrum 4.8.2 — desktop wallet wizard · Desktop menus
- Blockchain.com — imported Bitcoin addresses
- bitaddress.org — BIP38 and Wallet Details implementation
- Coinpunk — encrypted wallet model and change keys · Backup · Send
- Trezor Safe 3
- Trezor Safe 5
- Trezor Suite — trezor.io/start
- Trezor — official stores and authorised resellers
- Trezor — migrating from another wallet
- Trezor Suite — receiving and verifying an address
Checked on 19 September 2026 against primary documentation and source code. No real funds or private keys were used in testing. The table is not an exhaustive list or a diagnosis of your wallet.
FAQ
Does BitcoinJS 0.1.3 identify my wallet version?
No. It identifies a library example cited in the Randstorm disclosure. A wallet can bundle or modify that library without exposing its version to the user. The original wallet build and browser environment still need to be identified.
Does bitaddress.org 2.8.0 prove that my paper wallet is safe?
The changelog documents stronger entropy collection in 2.8.0. It does not certify how an individual key was generated, which browser features were available, or whether the file was modified. The article therefore treats it as a documented change, not a universal safety boundary.
Why does the paper-wallet route use Sweep instead of Import?
Import keeps the original private key in use. Sweep creates a transaction that transfers its spendable funds to the prepared destination wallet. The new wallet must have independently generated keys, and the destination and fee must be checked before broadcasting.
Can Electrum open a Coinpunk backup directly?
The inspected Coinpunk version stores an encrypted wallet payload, not an Electrum seed. Preserve the backup, login identifier and password. Recover the keys locally with version-specific expertise, then match them to the original addresses before using the sweep route.