'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto Wallets Actively Exploited to Drain $3.1M+

'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto (TL-2026-1170), also tracked as Ill Bloom, is a critical-severity software vulnerability scored CVSS 7.5, first published 2026-07-10. It has no confirmed attribution, affects Multiple (unnamed, undisclosed by Coinspect) Legacy and lesser-known, maps to 15 MITRE ATT&CK techniques (T1110.002, T1119, T1190), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-1170

Threat ID
TL-2026-1170
Also known as
Ill Bloom
Severity
CRITICAL
CVSS
7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-10
Last reviewed
2026-07-10
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
cryptocurrency, finance, fintech, consumer mobile applications
Target regions
Global
Detection rules
9
Indicators of compromise
23

Malware and tooling in 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto

Malware and tooling: Milk Sad-class seed-recovery tooling

Security firm Coinspect disclosed 'Ill Bloom', a critical vulnerability in older/lesser-known mobile cryptocurrency wallet apps (some dating to 2018) caused by an insecure pseudo-random number generator (PRNG) used during recovery-phrase generation, drastically shrinking the seed-phrase search space and letting attackers pre-compute vulnerable wallets and drain them the moment funds arrive. A coordinated sweep on 2026-05-27 drained roughly $3.14 million from 431 wallets across Bitcoin, Ethereum, Rootstock, Tron, and Polygon; over $5 million has been moved from exposed wallets in total since, including a further ~$2 million on 2026-07-05, with 2,114 exposed addresses showing on-chain activity identified as of 2026-06-30.

How 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto works

Coinspect, an Argentina-based blockchain security firm, disclosed a vulnerability class dubbed 'Ill Bloom' affecting recovery-phrase (BIP-39 mnemonic) generation in a subset of older and lesser-known mobile cryptocurrency wallet applications, some in circulation since 2018. The root cause is the wallet software's use of a weak, non-cryptographically-secure PRNG (rather than a CSPRNG) when generating entropy for new recovery phrases. This mirrors the well-documented pattern seen in the 2023 'Milk Sad' (Libbitcoin Explorer, CVE-2023-39910) and Trust Wallet browser extension (CVE-2023-31290) incidents, where a Mersenne Twister (mt19937) PRNG seeded with a low-entropy value (e.g., 32-bit system time) collapsed the theoretical 2^256 seed-phrase keyspace down to a brute-forceable ~2^32 (roughly 4.3 billion) possibilities.

Coinspect reconstructed the weak generator's output space, derived every wallet address the flawed algorithm could produce across Bitcoin, Ethereum, Rootstock, Tron, Polygon, Solana, BNB Chain, Monad, Arbitrum, Gnosis, Optimism, Base, Avalanche, Linea, and HyperEVM (all EVM-compatible or otherwise derivable from the same seed material), and cross-referenced the resulting address set against public blockchain records to find which of them held or previously held funds. This is the identical adversary tradecraft used by real-world attackers: pre-generate the full reduced keyspace offline, derive candidate addresses for every supported chain, and continuously monitor those addresses on-chain so that any deposit can be swept within seconds to minutes of confirmation.

On 2026-05-27, a coordinated, automated sweep operation drained approximately $3,140,968 from 431 of the exposed wallets in a single wave: ~$2.57 million in Bitcoin (a single BTC address alone lost over $1.1 million), $285,778 in Ethereum, $177,225 in Rootstock, $80,970 in Tron, and $23,473 in Polygon. Draining activity did not stop there — over $5 million total has been moved from exposed wallets since that date, including an additional roughly $2 million swept on 2026-07-05, indicating persistent, likely automated monitoring/sweeping infrastructure watching the vulnerable address set for new deposits. As of 2026-06-30, Coinspect had identified 2,114 exposed addresses showing on-chain activity — a figure the firm stresses is only a partial view, since it depends on which vulnerable seed-generation algorithms and wallet apps have been reverse-engineered so far; the true number of affected wallets is likely much higher. Hardware wallets and current mainstream software wallets are confirmed not affected — risk is concentrated in older, niche, or discontinued mobile hot-wallet apps.

Coinspect has withheld the names of the specific vulnerable wallet applications and the precise entropy-reduction magnitude, following a staged/limited disclosure approach: technical details are being shared privately with affected wallet vendors while public information is deliberately restricted to slow follow-on exploitation by additional threat actors, even as the vulnerability is already under active, ongoing exploitation. Coinspect published a public checker tool at illbloom.org that compares user-supplied public addresses (never private keys or seed phrases) against Coinspect's dataset of known-vulnerable addresses with confirmed historical balances, across Bitcoin, Tron, Solana, and EVM-compatible chains.

Remediation is unusually strict for this vulnerability class: because the underlying entropy defect lives in the seed-generation code path itself, neither updating the vulnerable app nor re-importing the same recovery phrase into a different, non-vulnerable wallet remediates exposure — the original phrase is permanently compromised because its derivation space was never large enough to be secret. Affected users must generate an entirely new recovery phrase (ideally on a hardware device or an audited, mainstream software wallet using a proper CSPRNG) and migrate all funds to fresh addresses derived from that new phrase.

This is the third major disclosed incident in a recurring pattern of weak-RNG seed-generation flaws in cryptocurrency wallet software, following Milk Sad (Libbitcoin Explorer 'bx seed', CVE-2023-39910, disclosed August 2023, mt19937 seeded with 32-bit system time, over 227,200 Bitcoin wallets historically at risk, actively exploited June-July 2023) and the Trust Wallet browser extension flaw (CVE-2023-31290, disclosed 2023, Trust Wallet Core before 3.1.1 / extension before 0.0.183, also a 32-bit mt19937 seed, exploited in the wild December 2022 and March 2023 with over $6 million stolen), as well as the older 'Randstorm' class of JavaScript CSPRNG weaknesses in browser-based wallets generated between 2011-2015. No CVE has been assigned to the Ill Bloom vulnerability class as of publication, and no CVSS score has been published by Coinspect; this record uses a CRITICAL qualitative severity and a CVSS 3.1 base score aligned to the closely analogous CWE-338 precedent (CVE-2023-39910), reflecting the demonstrated, low-complexity, unauthenticated, actively-exploited fund-theft impact.

MITRE ATT&CK techniques used in TL-2026-1170

Credential Access

T1110.002 Password Cracking; T1528 Steal Application Access Token; T1552.004 Private Keys

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1531 Account Access Removal; T1657 Financial Theft

Discovery

T1580 Cloud Infrastructure Discovery

Resource Development

T1587.001 Malware; T1587.004 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1592.004 Client Configurations; T1595 Active Scanning

Affected products and versions in 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto

  • Multiple (unnamed, undisclosed by Coinspect) — Legacy and lesser-known mobile cryptocurrency wallet applications
    Vulnerable versions: Wallets with recovery phrases generated 2018-2026 using vendor-specific weak PRNG entropy sources
    Fixed in: None — mitigation requires generating a new recovery phrase on unaffected software, not a version update
  • Multi-chain — Bitcoin, Ethereum, Rootstock, Tron, Polygon, Solana, BNB Chain, Monad, Arbitrum, Gnosis, Optimism, Base, Avalanche, Linea, HyperEVM addresses derived from vulnerable seed phrases
    Vulnerable versions: All addresses derived from an Ill-Bloom-affected recovery phrase, regardless of chain
    Fixed in: N/A — chain-agnostic wallet-software defect

Remediation for 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto

Patches

  • No vendor patch is available because Coinspect has not publicly named the affected wallet applications; disclosure to vendors is ongoing under a staged/limited-disclosure process

Immediate actions

  • Check exposure of any public wallet address created before mid-2026 using the Coinspect Ill Bloom checker at illbloom.org (public addresses only — never enter private keys or seed phrases)
  • Treat any recovery phrase generated by an older or lesser-known mobile wallet app (especially apps in use since 2018) as compromised and unsafe to continue using
  • Do not deposit or leave additional funds in any wallet flagged as exposed, even temporarily
  • Move any remaining funds out of a flagged wallet immediately using the existing (compromised) phrase as a one-time evacuation transaction, monitored for front-running

Workarounds

  • Updating the vulnerable app to its latest version does NOT remediate exposure — the already-generated recovery phrase remains permanently compromised
  • Re-importing the same compromised recovery phrase into a different, non-vulnerable wallet app does NOT remediate exposure — a brand-new phrase must be generated

Longer-term hardening

  • Generate a brand-new recovery phrase using a hardware wallet or an audited, mainstream software wallet with a verified CSPRNG-based entropy source, then migrate all funds to fresh addresses
  • Audit any in-house or white-label wallet software for use of Mersenne Twister (mt19937), rand()/mt_rand(), or any non-CSPRNG source (e.g. /dev/urandom substitutes, low-entropy system time seeding) in mnemonic/entropy generation code paths
  • Adopt BIP-39/SLIP-0010 reference implementations backed by an OS-provided CSPRNG (e.g. getrandom(2), CryptGenRandom, SecRandomCopyBytes) with full 128-256 bits of entropy
  • Wallet vendors should commission independent cryptographic/entropy audits before shipping recovery-phrase generation code

Weaknesses (CWE) in 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto

CWE-338, CWE-330, CWE-331

Timeline of 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto

  • Precedent context: Mersenne Twister (MT19937) PRNG is introduced into the Libbitcoin Explorer codebase via pull request #559, the code path that would later become the root cause of the analogous Milk Sad vulnerability (CVE-2023-39910).
  • Precedent context: The MT19937-based 'bx seed' entropy generation ships in Libbitcoin Explorer (bx) 3.0.0, exposing the 32-bit clock-seeded keyspace-reduction flaw to production wallet users years before disclosure.
  • Estimated earliest point at which affected legacy/lesser-known mobile wallet apps began generating recovery phrases using the weak, non-cryptographically-secure PRNG later identified as the Ill Bloom root cause.
  • Precedent context: The Cake Wallet vulnerability is disclosed, in which the app used Dart's non-cryptographic Random() class (falling back to system time as a seed) for key generation — an earlier example of the same recurring weak-RNG wallet-drain pattern later seen in Milk Sad and Ill Bloom.
  • The closely analogous Milk Sad vulnerability (CVE-2023-39910, Libbitcoin Explorer 'bx seed', 32-bit mt19937 entropy) is actively exploited in the wild in a major coordinated Bitcoin theft (~$850K-900K USD across three transactions), establishing the same weak-RNG wallet-drain attack pattern later seen in Ill Bloom.
  • Precedent context: CVE-2023-39910 is formally assigned by MITRE for the Milk Sad vulnerability and the Milk Sad research team's technical disclosure is published, documenting the mt19937/32-bit-seed root cause later cited as Ill Bloom's closest analog.
  • A coordinated, automated sweep drains approximately $3,140,968 from 431 exposed wallets across Bitcoin (~$2.57M), Ethereum ($285,778), Rootstock ($177,225), Tron ($80,970), and Polygon ($23,473) — the first confirmed on-chain evidence of active Ill Bloom exploitation.
  • Coinspect compiles and publishes internally the 'Ill Bloom Exposed Address Set 1' dataset of known-vulnerable, previously-funded addresses, later used to power the public illbloom.org checker tool.
  • Coinspect identifies 2,114 exposed wallet addresses showing on-chain activity across the affected blockchains, noting the true scope is likely larger since it depends on which vulnerable seed-generation algorithms have been reverse-engineered.
  • An additional approximately $2 million is swept from exposed wallets, bringing total confirmed losses since May 27 to over $5 million and indicating persistent, likely automated monitoring of the exposed address set.
  • Coinspect publicly discloses the Ill Bloom vulnerability class and launches a public checker tool at illbloom.org, while withholding the names of specific affected wallet vendors under a staged/limited-disclosure approach.
  • The Hacker News and other outlets report on active exploitation of Ill Bloom, amplifying public awareness and driving affected users toward the Coinspect checker tool.

Sources cited for 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto

Threats related to 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto

Detection coverage for TL-2026-1170

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1170 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats