Ill Bloom Wallet Entropy Vulnerability

On July 10, 2026, security firm Coinspect disclosed a wallet vulnerability it dubbed Ill Bloom — a weakness in how some wallet software generates its recovery phrase — after attackers had already used it to drain more than $5 million from exposed wallets across six chains.

What happened

The flaw sits in the seed-phrase generation of certain wallets. A recovery phrase is only as unpredictable as the randomness used to create it; Ill Bloom-affected software drew on weak randomness (an insecure PRNG), shrinking the range of possible phrases far below the astronomical space a wallet is supposed to have. That reduction let an attacker brute-force the private keys and sweep everything the phrase controlled.

Coinspect said the issue affects wallets created across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana, and that the vulnerable generation mechanism has existed since at least 2018. The real exposure sits with older or lesser-known wallets — both mobile apps and browser extensions. According to the firm, hardware wallets are not affected, and neither are most mainstream software wallets.

The firm analysed a set of 2,114 addresses it flagged as at risk and documented active exploitation. On May 27, 2026, it recorded a coordinated sweep that drained roughly $3.1 million from 431 wallets — the majority, about $2.57 million, in Bitcoin — which it described as the "confirmed minimum damage." Coinspect later told reporters that a further $2.1 million in USDT was taken from an exposed wallet, pushing confirmed losses past $5 million.

Aftermath

• Coinspect published the disclosure to warn holders and urge migration; the recommended remediation is to generate a brand-new wallet from a fresh recovery phrase and move funds to addresses derived from it, since the exposed keys cannot be made safe.
• Because the weakness is in key generation rather than a single contract or exchange, there is no patch that retroactively secures already-created wallets — affected users must move funds off the vulnerable addresses.
• No funds had been recovered at the time of writing, and the attackers remained unidentified; the status is stolen.

Why it matters

Ill Bloom belongs to a recurring and dangerous class of failure: broken randomness at the moment a key is born. When a wallet's entropy source is predictable, the strongest passphrase and the most careful cold-storage habits are irrelevant — the key was already guessable the day it was created, and the theft can happen silently years later. That makes it different from the runtime key thefts behind Atomic Wallet and the Slope wallet incident, where keys leaked through compromised infrastructure or logging; here the keys were never truly random to begin with.

The lesson is uncomfortable because it is unfixable after the fact: a wallet's security rests entirely on the quality of its random number generator, an implementation detail users cannot inspect. Ill Bloom is a reminder that self-custody assumes the software did the one thing it can never be seen doing correctly — and that when it does not, the safest response is not to patch, but to abandon the address and start over.