Skip to navigation

Threat reportVulnerabilityTL-2026-1170

'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto Wallets Actively Exploited to Drain $3.1M+

criticalACTIVE

Security firm Coinspect disclosed 'Ill Bloom', a critical vulnerability in older/lesser-known mobile cryptocurrency wallet apps (some dating to 2018) caused by an insecure pseudo-random number generator (PRNG) used during recovery-phrase generation, drastically shrinking the seed-phrase search space and letting attackers pre-compute vulnerable wallets and drain them the moment funds arrive.

Key facts

IdentifiersTL-2026-1170, CVE-2023-31290, CVE-2023-39910
Also known asIll Bloom
SeverityCRITICAL
CVSS7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
EPSSCVE-2023-39910: 1.8% (77.9th percentile); CVE-2023-31290: 1.0% (63.2th percentile)
Affected productsMultiple (unnamed, undisclosed by Coinspect) Legacy and lesser-known mobile cryptocurrency wallet applications; Multi-chain Bitcoin, Ethereum, Rootstock, Tron, Polygon, Solana, BNB Chain, Monad, Arbitrum, Gnosis, Optimism, Base, Avalanche, Linea, HyperEVM addresses derived from vulnerable seed phrases
Weaknesses (CWE)CWE-338, CWE-330, CWE-331
MalwareMilk Sad-class seed-recovery tooling
MITRE ATT&CK techniquesT1110.002 Password Cracking, T1119 Automated Collection, T1190 Exploit Public-Facing Application, T1213 Data from Information Repositories, T1528 Steal Application Access Token, T1531 Account Access Removal, T1552.004 Private Keys, T1580 Cloud Infrastructure Discovery, T1587.001 Malware, T1587.004 Exploits, T1588.006 Vulnerabilities, T1589 Gather Victim Identity Information and 3 more in the attack flow
MotivationFINANCIAL
Target sectorscryptocurrency, finance, fintech, consumer mobile applications
Target regionsGlobal
Detection rules9 (1 shown free)
Sources15 cited sources

Detection coverage

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1170 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Weak-PRNG Wallet Seed/Mnemonic Generation (Ill Bloom / CWE-338 Pattern) — SPL

Detects a process invoking a non-cryptographic PRNG API (PowerShell Get-Random, .NET System.Random, or a scripting-language random module) in the same execution context as file writes named for seed/mnemonic/recovery material. This is the exploitation-stage artifact of the Ill Bloom class of vulnerabilities, where wallet software derives BIP-39 recovery phrases from a low-entropy, non-CSPRNG source instead of an OS CSPRNG.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1552.004, T1587.004
  • Data sources: sysmon, windows_security
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(CommandLine, "(?i)get-random|system\.random")
| join type=inner ProcessGuid
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      | where match(TargetFilename, "(?i)seed|mnemonic|recovery")
      | fields ProcessGuid, TargetFilename ]
| table _time, ComputerName, User, Image, CommandLine, TargetFilename, ProcessGuid
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("Get-Random", "System.Random")
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName has_any ("seed", "mnemonic", "recovery")
) on $left.DeviceId == $right.DeviceId, $left.InitiatingProcessId == $right.InitiatingProcessId
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName

Sigma

title: Weak PRNG Usage Pattern in Wallet-Style Entropy Generation (Ill Bloom / CWE-338 Class)
id: 8f3d6f6a-1170-4a1c-9f0a-illbloom001
status: experimental
description: Detects a process invoking a non-cryptographic PRNG API together with file writes named for seed/mnemonic/recovery material, consistent with the Ill Bloom / Milk Sad weak-entropy wallet-key-generation flaw.
references:
    - https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html
    - https://illbloom.org/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39910
author: Threadlinqs Team
date: 2026-07-10
tags:
    - attack.credential-access
    - attack.t1552.004
    - attack.resource-development
    - attack.t1587.004
    - cve.2023.39910
logsource:
    category: process_creation
    product: windows
detection:
    selection_process:
        Image|endswith:
            - '\\powershell.exe'
            - '\\pwsh.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'Get-Random'
            - 'System.Random'
    selection_output:
        CommandLine|contains:
            - 'seed'
            - 'mnemonic'
            - 'recovery'
    condition: selection_process and selection_cmdline and selection_output
falsepositives:
    - Legitimate developer testing of PRNG APIs unrelated to wallet software
    - Non-cryptographic randomness used intentionally for non-secret purposes (e.g. UI shuffling)
level: high

Known false positives:

  • Legitimate developer or QA testing of PRNG APIs unrelated to wallet key generation
  • Games or UI code intentionally using non-cryptographic randomness for non-secret purposes

Tuning notes: Scope the join window tighter (e.g. same-process, <5s) to reduce noise from unrelated PowerShell sessions; add an allow-list for known dev/test hosts running wallet software unit tests.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Wallet Recovery-Phrase Generation via Non-CSPRNG API — KQL · unlock with TL Creds
  • Offline Reduced-Keyspace Brute-Force Candidate Enumeration — KQL · unlock with TL Creds
  • Automated Multi-Chain Sweep-Transfer Command Following Balance-Poll — KQL · unlock with TL Creds
  • Weak PRNG Usage Pattern in Wallet-Style Entropy Generation (Ill Bloom / CWE-338 Class) — Sigma · unlock with TL Creds
  • Deterministic Weak-PRNG Replay / Reduced-Keyspace Enumeration — Sigma · unlock with TL Creds
  • Automated Address-Monitoring / Fund-Sweep Loop Pattern (Ill Bloom-Style) — Sigma · unlock with TL Creds
  • Sequential Low-Entropy Seed Brute-Force / Keyspace Sweep — SPL · unlock with TL Creds
  • Automated Address-Monitoring / Fund-Sweep Loop (Ill Bloom Sweep Pattern) — SPL · unlock with TL Creds

Indicators of compromise

As of 2026-07-10, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-1170.

23 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

A coordinated sweep on 2026-05-27 drained roughly $3.14 million from 431 wallets across Bitcoin, Ethereum, Rootstock, Tron, and Polygon; over $5 million has been moved from exposed wallets in total since, including a further ~$2 million on 2026-07-05, with 2,114 exposed addresses showing on-chain activity identified as of 2026-06-30.

Coinspect, an Argentina-based blockchain security firm, disclosed a vulnerability class dubbed 'Ill Bloom' affecting recovery-phrase (BIP-39 mnemonic) generation in a subset of older and lesser-known mobile cryptocurrency wallet applications, some in circulation since 2018. The root cause is the wallet software's use of a weak, non-cryptographically-secure PRNG (rather than a CSPRNG) when generating entropy for new recovery phrases. This mirrors the well-documented pattern seen in the 2023 'Milk Sad' (Libbitcoin Explorer, CVE-2023-39910) and Trust Wallet browser extension (CVE-2023-31290) incidents, where a Mersenne Twister (mt19937) PRNG seeded with a low-entropy value (e.g., 32-bit system time) collapsed the theoretical 2^256 seed-phrase keyspace down to a brute-forceable ~2^32 (roughly 4.3 billion) possibilities.

Coinspect reconstructed the weak generator's output space, derived every wallet address the flawed algorithm could produce across Bitcoin, Ethereum, Rootstock, Tron, Polygon, Solana, BNB Chain, Monad, Arbitrum, Gnosis, Optimism, Base, Avalanche, Linea, and HyperEVM (all EVM-compatible or otherwise derivable from the same seed material), and cross-referenced the resulting address set against public blockchain records to find which of them held or previously held funds. This is the identical adversary tradecraft used by real-world attackers: pre-generate the full reduced keyspace offline, derive candidate addresses for every supported chain, and continuously monitor those addresses on-chain so that any deposit can be swept within seconds to minutes of confirmation.

On 2026-05-27, a coordinated, automated sweep operation drained approximately $3,140,968 from 431 of the exposed wallets in a single wave: ~$2.57 million in Bitcoin (a single BTC address alone lost over $1.1 million), $285,778 in Ethereum, $177,225 in Rootstock, $80,970 in Tron, and $23,473 in Polygon. Draining activity did not stop there — over $5 million total has been moved from exposed wallets since that date, including an additional roughly $2 million swept on 2026-07-05, indicating persistent, likely automated monitoring/sweeping infrastructure watching the vulnerable address set for new deposits. As of 2026-06-30, Coinspect had identified 2,114 exposed addresses showing on-chain activity — a figure the firm stresses is only a partial view, since it depends on which vulnerable seed-generation algorithms and wallet apps have been reverse-engineered so far; the true number of affected wallets is likely much higher. Hardware wallets and current mainstream software wallets are confirmed not affected — risk is concentrated in older, niche, or discontinued mobile hot-wallet apps.

Coinspect has withheld the names of the specific vulnerable wallet applications and the precise entropy-reduction magnitude, following a staged/limited disclosure approach: technical details are being shared privately with affected wallet vendors while public information is deliberately restricted to slow follow-on exploitation by additional threat actors, even as the vulnerability is already under active, ongoing exploitation. Coinspect published a public checker tool at illbloom.org that compares user-supplied public addresses (never private keys or seed phrases) against Coinspect's dataset of known-vulnerable addresses with confirmed historical balances, across Bitcoin, Tron, Solana, and EVM-compatible chains.

Remediation is unusually strict for this vulnerability class: because the underlying entropy defect lives in the seed-generation code path itself, neither updating the vulnerable app nor re-importing the same recovery phrase into a different, non-vulnerable wallet remediates exposure — the original phrase is permanently compromised because its derivation space was never large enough to be secret. Affected users must generate an entirely new recovery phrase (ideally on a hardware device or an audited, mainstream software wallet using a proper CSPRNG) and migrate all funds to fresh addresses derived from that new phrase.

This is the third major disclosed incident in a recurring pattern of weak-RNG seed-generation flaws in cryptocurrency wallet software, following Milk Sad (Libbitcoin Explorer 'bx seed', CVE-2023-39910, disclosed August 2023, mt19937 seeded with 32-bit system time, over 227,200 Bitcoin wallets historically at risk, actively exploited June-July 2023) and the Trust Wallet browser extension flaw (CVE-2023-31290, disclosed 2023, Trust Wallet Core before 3.1.1 / extension before 0.0.183, also a 32-bit mt19937 seed, exploited in the wild December 2022 and March 2023 with over $6 million stolen), as well as the older 'Randstorm' class of JavaScript CSPRNG weaknesses in browser-based wallets generated between 2011-2015. No CVE has been assigned to the Ill Bloom vulnerability class as of publication, and no CVSS score has been published by Coinspect; this record uses a CRITICAL qualitative severity and a CVSS 3.1 base score aligned to the closely analogous CWE-338 precedent (CVE-2023-39910), reflecting the demonstrated, low-complexity, unauthenticated, actively-exploited fund-theft impact.

MITRE ATT&CK techniques by tactic:

Credential Access

T1110.002 Password Cracking; T1528 Steal Application Access Token; T1552.004 Private Keys

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1531 Account Access Removal; T1657 Financial Theft

Discovery

T1580 Cloud Infrastructure Discovery

Resource Development

T1587.001 Malware; T1587.004 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1592.004 Client Configurations; T1595 Active Scanning

Remediation

Patches

  • No vendor patch is available because Coinspect has not publicly named the affected wallet applications; disclosure to vendors is ongoing under a staged/limited-disclosure process

Immediate actions

  • Check exposure of any public wallet address created before mid-2026 using the Coinspect Ill Bloom checker at illbloom.org (public addresses only — never enter private keys or seed phrases)
  • Treat any recovery phrase generated by an older or lesser-known mobile wallet app (especially apps in use since 2018) as compromised and unsafe to continue using
  • Do not deposit or leave additional funds in any wallet flagged as exposed, even temporarily
  • Move any remaining funds out of a flagged wallet immediately using the existing (compromised) phrase as a one-time evacuation transaction, monitored for front-running

Workarounds

  • Updating the vulnerable app to its latest version does NOT remediate exposure — the already-generated recovery phrase remains permanently compromised
  • Re-importing the same compromised recovery phrase into a different, non-vulnerable wallet app does NOT remediate exposure — a brand-new phrase must be generated

Longer-term hardening

  • Generate a brand-new recovery phrase using a hardware wallet or an audited, mainstream software wallet with a verified CSPRNG-based entropy source, then migrate all funds to fresh addresses
  • Audit any in-house or white-label wallet software for use of Mersenne Twister (mt19937), rand()/mt_rand(), or any non-CSPRNG source (e.g. /dev/urandom substitutes, low-entropy system time seeding) in mnemonic/entropy generation code paths
  • Adopt BIP-39/SLIP-0010 reference implementations backed by an OS-provided CSPRNG (e.g. getrandom(2), CryptGenRandom, SecRandomCopyBytes) with full 128-256 bits of entropy
  • Wallet vendors should commission independent cryptographic/entropy audits before shipping recovery-phrase generation code

Affected and fixed versions

  • Multiple (unnamed, undisclosed by Coinspect) — Legacy and lesser-known mobile cryptocurrency wallet applications
    Vulnerable versions: Wallets with recovery phrases generated 2018-2026 using vendor-specific weak PRNG entropy sources
    Fixed in: None — mitigation requires generating a new recovery phrase on unaffected software, not a version update
  • Multi-chain — Bitcoin, Ethereum, Rootstock, Tron, Polygon, Solana, BNB Chain, Monad, Arbitrum, Gnosis, Optimism, Base, Avalanche, Linea, HyperEVM addresses derived from vulnerable seed phrases
    Vulnerable versions: All addresses derived from an Ill-Bloom-affected recovery phrase, regardless of chain
    Fixed in: N/A — chain-agnostic wallet-software defect

Timeline

  • Precedent context: Mersenne Twister (MT19937) PRNG is introduced into the Libbitcoin Explorer codebase via pull request #559, the code path that would later become the root cause of the analogous Milk Sad vulnerability (CVE-2023-39910).
  • Precedent context: The MT19937-based 'bx seed' entropy generation ships in Libbitcoin Explorer (bx) 3.0.0, exposing the 32-bit clock-seeded keyspace-reduction flaw to production wallet users years before disclosure.
  • Estimated earliest point at which affected legacy/lesser-known mobile wallet apps began generating recovery phrases using the weak, non-cryptographically-secure PRNG later identified as the Ill Bloom root cause.
  • Precedent context: The Cake Wallet vulnerability is disclosed, in which the app used Dart's non-cryptographic Random() class (falling back to system time as a seed) for key generation — an earlier example of the same recurring weak-RNG wallet-drain pattern later seen in Milk Sad and Ill Bloom.
  • The closely analogous Milk Sad vulnerability (CVE-2023-39910, Libbitcoin Explorer 'bx seed', 32-bit mt19937 entropy) is actively exploited in the wild in a major coordinated Bitcoin theft (~$850K-900K USD across three transactions), establishing the same weak-RNG wallet-drain attack pattern later seen in Ill Bloom.
  • Precedent context: CVE-2023-39910 is formally assigned by MITRE for the Milk Sad vulnerability and the Milk Sad research team's technical disclosure is published, documenting the mt19937/32-bit-seed root cause later cited as Ill Bloom's closest analog.
  • A coordinated, automated sweep drains approximately $3,140,968 from 431 exposed wallets across Bitcoin (~$2.57M), Ethereum ($285,778), Rootstock ($177,225), Tron ($80,970), and Polygon ($23,473) — the first confirmed on-chain evidence of active Ill Bloom exploitation.
  • Coinspect compiles and publishes internally the 'Ill Bloom Exposed Address Set 1' dataset of known-vulnerable, previously-funded addresses, later used to power the public illbloom.org checker tool.
  • Coinspect identifies 2,114 exposed wallet addresses showing on-chain activity across the affected blockchains, noting the true scope is likely larger since it depends on which vulnerable seed-generation algorithms have been reverse-engineered.
  • An additional approximately $2 million is swept from exposed wallets, bringing total confirmed losses since May 27 to over $5 million and indicating persistent, likely automated monitoring of the exposed address set.
  • Coinspect publicly discloses the Ill Bloom vulnerability class and launches a public checker tool at illbloom.org, while withholding the names of specific affected wallet vendors under a staged/limited-disclosure approach.
  • The Hacker News and other outlets report on active exploitation of Ill Bloom, amplifying public awareness and driving affected users toward the Coinspect checker tool.

Sources cited

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 15 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats