Ill Bloom: 431 Wallets Drained for $3.1M via Insecure PRNG

The Ill Bloom vulnerability exposed 2,114 crypto addresses due to weak pseudorandom number generators. No patch exists: the only defense is migrating to a wallet with proper entropy.

On May 27, 2026, a coordinated attack drained 431 software wallets of roughly $3.1 million by exploiting a structural weakness hidden for years: insecure pseudorandom number generators used when creating certain mobile apps. Coinspect's disclosure, published in early July, reveals the problem is not a patchable bug but a design flaw rooted in the seed phrase itself, immutable from the moment of generation.

Key Takeaways

2,114 vulnerable addresses were identified with on-chain activity across at least six blockchains as of June 30, 2026.
Hardware wallets such as Ledger and Trezor are not affected; risk is concentrated in lesser-known mobile apps, some active since 2018.
Coinspect reproduced the attack end-to-end by generating the full set of weak seed phrases and matching them against the blockchain.
No patch exists: updating the app or reimporting the same phrase into different software does not fix the problem.

The Mechanism: When Randomness Isn't Random

The security of the BIP-39 standard, which governs seed phrase generation for self-custody wallets, depends on 128-256 bits of initial entropy produced by a cryptographically secure generator (CSPRNG). Some mobile software wallets instead implemented deterministic PRNGs with predictable seeding, typically based on system timestamps or other easily enumerable inputs.

The consequence is a drastic reduction of the keyspace: from 2^128 theoretical combinations to a finite, calculable set. An attacker who reconstructs the PRNG pattern can regenerate every possible weak seed phrase, derive public addresses on every supported chain, and cross-reference them against the blockchain to find those holding a balance. Once executed, the same attack simultaneously exposes all derivations of that seed: Bitcoin, Ethereum, Tron, Rootstock, Polygon, Solana, and potentially others.

Coinspect documented this end-to-end reproduction: it generated the complete set of weak phrases, derived the corresponding addresses, and matched them against on-chain data. The result is the "Ill Bloom Exposed Address Set 1 of June 2026," which counted 2,114 addresses with detectable activity as of June 30.

The Sweep Numbers and Subsequent Movements

The May 27 attack struck asymmetrically: Bitcoin absorbed the bulk of losses, with roughly $2.57 million stolen. A single address lost over $1.1 million. Ethereum, Tron, and other chains accounted for the remaining total.

"If funds have moved recently without your permission, this vulnerability could be the reason." — Coinspect

In the period following May 27, converging sources reported additional movements of roughly $2 million from exposed addresses. The distinction between active theft and preventive user migration remains undetermined: some of those movements may represent users who responded to the alert by transferring funds to secure wallets. TechTimes presented a combined figure of $5 million as a single total, a slightly different framing that does not separate these two components.

The historical peak of the exposed set was reached in April 2022, with roughly $12.56 million concentrated in vulnerable addresses. The subsequent decline does not indicate resolution of the problem, but rather market fluctuations and natural fund movements.

What to Do Now

For users with self-custody wallets created on lesser-known mobile apps, especially before 2025, the documented actions are four.

Verify exposure. Coinspect published a free tool at illbloom.org that requires only the public address, never the seed phrase or private key. The check is non-interactive with the wallet and does not expose sensitive data.

Create a new wallet with proper entropy. The official remediation is generating a new seed phrase with a verified software or hardware wallet, preferably one with a public cryptographic audit.

Transfer funds. Complete migration of the balance to the new address is the only documented effective measure. Reimporting the same seed phrase into a different app does not eliminate the weakness.

Stay vigilant against scam attempts. Coinspect explicitly stated it will never request seed phrases, private keys, signatures, or transfers to "recovery" addresses. Any such request is fraudulent.

The Regulatory Void on Entropy Generators

The Ill Bloom episode highlights a structural gap in the BIP-39 standard: it does not mandate the use of a CSPRNG, leaving implementation to vendor discretion. The result is an ecosystem where entropy generation quality varies invisibly to the user, and wallets with identical interfaces can hide radically different cryptographic foundations.

Comparison with previous similar vulnerability classes — Milk Sad in 2023 and Randstorm in 2024 — does not lessen the gravity of this case. On the contrary, the persistence of this failure pattern suggests the industry has not developed effective mechanisms for independent verification of the wallet's most sensitive component: the moment of its cryptographic birth.

The name "Ill Bloom" derives from "illness blossom," the first weak phrase produced by the flawed generator analyzed — a convention mirroring the one established with "milk sad." The unintentional poetry masks a software engineering problem that directly concerns the financial sovereignty promised by self-custody.

Frequently Asked Questions

How do I know if my wallet is at risk?

The official tool at illbloom.org verifies exposure based on the public address. If the wallet was created with a Ledger or Trezor hardware wallet, current evidence excludes risk. For lesser-known mobile apps, especially those used from 2018 onward, verification is recommended.

Why isn't updating the app enough?

The weakness lies in the seed phrase generated at wallet creation, not in the software that uses it. The seed phrase contains the initial entropy: if that is predictable, any app that imports it will derive the same exposed addresses.

Are mainstream wallets like MetaMask or Trust Wallet vulnerable?

According to Coinspect, "further research indicates that most current software wallets are not vulnerable." Risk is concentrated in lesser-known applications that have not published cryptographic audits on entropy generation.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references