Security researchers at Coinspect have disclosed a critical weakness in cryptocurrency wallet software that has already led to the theft of at least $3.1 million. Dubbed Ill Bloom, the flaw stems from a predictable random-number generator used to create wallet recovery phrases, allowing attackers to reconstruct seed phrases and drain funds from vulnerable wallets.
On May 27, a single coordinated sweep emptied approximately $3.1 million from 431 wallets. Coinspect reports that roughly $2 million more has moved from exposed wallets since that date, though it remains unclear how much of that flow represents additional theft versus legitimate owners moving funds to safety. The firm put it plainly: “if funds recently moved without your permission, this vulnerability may be why.”
What Causes the Ill Bloom Vulnerability
Every self-custody cryptocurrency wallet begins with a recovery phrase — typically 12 or 24 words — that acts as the master key to the funds. Under normal conditions, the software selects these words from an astronomically large pool of possibilities, making brute-force guessing infeasible. The wallets affected by Ill Bloom used a weak random-number generator when creating the phrase, collapsing that immense search space into a range small enough for an attacker to enumerate exhaustively. Coinspect has not disclosed the exact size of the reduced pool, but the practical consequence is clear: wallets that appeared secure were born vulnerable.
Hardware wallets and most mainstream software wallets are not affected. The real risk concentrates in older or lesser-known mobile wallets, some dating back to 2018. Coinspect has not named the specific applications involved, leaving users to determine their exposure through other means.
How to Check Whether Your Wallet Is at Risk
Coinspect has made a free checking tool available at illbloom.org. Users can paste any public wallet address into the checker to see whether it appears on the firm’s watchlist of vulnerable addresses. The tool supports Bitcoin, Tron, Solana, and Ethereum-style addresses, including those on Polygon, BNB Chain, and other EVM-compatible networks. Because a single weak recovery phrase can expose funds on every blockchain it controls, users should check every address tied to the same seed — not just the one already drained. A clean result does not guarantee safety, as the list is still incomplete, but a match represents a clear warning that the recovery phrase should be treated as compromised.
The Scope of the Theft So Far
As of June 30, Coinspect had mapped 2,114 exposed addresses with on-chain activity across Bitcoin, Ethereum, Rootstock, Tron, and Polygon. The May 27 sweep drained about $3.1 million from 431 of those addresses, with Bitcoin absorbing the heaviest losses at roughly $2.57 million. A single Bitcoin address lost more than $1.1 million. Coinspect identified the event as a coordinated theft because hundreds of unrelated wallets sent their balances to the same small set of collection addresses within hours. Counting all movements since May 27, more than $5 million has left these wallets; Coinspect calls that a floor, not a ceiling. At its 2022 peak, the same set of addresses held a reconstructed value of $12.56 million, though most of that value had already fallen with the broader market before the May 27 sweep.
What to Do If Your Address Is on the List
Anyone who finds a match at illbloom.org should take three immediate steps:
- Treat the existing recovery phrase as compromised. The funds are not safe simply because they have not moved yet.
- Create a brand-new wallet with a brand-new recovery phrase. You should see a fresh set of 12 to 24 words generated by the new software. If an app asks you to type in your old phrase, you are reopening the weak wallet, not creating a new one.
- Move all funds to the new wallet. Reinstalling the old app or importing the compromised phrase into different software changes nothing — the key itself is weak.
Scammers often exploit incidents like this by posing as recovery services. A legitimate checker never requires a secret. Coinspect states it “will never ask for seed phrases, private keys, signatures, or approvals, or ask users to send funds to ‘recover’ or protect a wallet.” Users should never type a recovery phrase, private key, password, or backup file into any website or message. The safest destination for moved funds is a hardware wallet, but the new phrase must be generated on the device itself, not imported from the old one.
Ill Bloom in Context: A Recurring Failure in Randomness
The Ill Bloom flaw follows a pattern the cryptocurrency security community has seen repeatedly. Coinspect took the name from “illness blossom,” the first weak phrase produced by the vulnerable generator — the same naming convention used for the Milk Sad vulnerability (CVE-2023-39910) in the Libbitcoin Explorer tool, which enabled a multi-million-dollar sweep in July 2023. That same year, a close cousin (CVE-2023-31290) affected the Trust Wallet browser extension, making its recovery phrases crackable in under a day. The Randstorm weakness, covered widely in 2023, left Bitcoin wallets created between 2011 and 2015 permanently vulnerable because the browser-based code that generated them relied on poor randomness. In every case, the flaw was baked into the wallet from its creation, and the only fix was to move the funds to a new wallet generated with trustworthy software. Ill Bloom is the same story with a new name.
A Predictable Key Is Barely a Key at All
The open question now is which wallet applications generated the weak phrases. A public address does not reveal the software that created it, so Coinspect is asking matched users to report what they used and is sharing findings with vendors and development teams who can act on them. For the broader community of cryptocurrency users, this incident reinforces a fundamental lesson: security depends not on how random a recovery phrase looks, but on whether the machine that chose it was genuinely unpredictable. A predictable key, no matter how complex it appears, provides no real protection. Anyone using a wallet created years ago on a mobile device — especially one that is no longer actively maintained — should verify its safety today using the available checker, and move funds to a freshly generated wallet on a hardware device or established software client with a proven random-number generator.
