'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto Wallets Actively Exploited to Drain $3.1M+ — Threadlinqs Intelligence
As of 2026-07-10, 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto Wallets Actively Exploited to Drain $3.1M+ is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1170 · Severity: CRITICAL · CVSS: 7.5 · Status: ACTIVE · Category: VULNERABILITY
Security firm Coinspect disclosed 'Ill Bloom', a critical vulnerability in older/lesser-known mobile cryptocurrency wallet apps (some dating to 2018) caused by an insecure pseudo-random number
Coinspect, an Argentina-based blockchain security firm, disclosed a vulnerability class dubbed 'Ill Bloom' affecting recovery-phrase (BIP-39 mnemonic) generation in a subset of older and lesser-known mobile cryptocurrency wallet applications, some in circulation since 2018. The root cause is the wallet software's use of a weak, non-cryptographically-secure PRNG (rather than a CSPRNG) when generating entropy for new recovery phrases. This mirrors the well-documented pattern seen in the 2023 'Milk Sad' (Libbitcoin Explorer, CVE-2023-39910) and Trust Wallet browser extension (CVE-2023-31290) incidents, where a Mersenne Twister (mt19937) PRNG seeded with a low-entropy value (e.g., 32-bit system time) collapsed the theoretical 2^256 seed-phrase keyspace down to a brute-forceable ~2^32 (roughly 4.3 billion) possibilities.
Coinspect reconstructed the weak generator's output space, derived every wallet address the flawed algorithm could produce across Bitcoin, Ethereum, Rootstock, Tron, Polygon, Solana, BNB Chain, Monad, Arbitrum, Gnosis, Optimism, Base, Avalanche, Linea, and HyperEVM (all EVM-compatible or otherwise derivable from the same seed material), and cross-referenced the resulting address set against public blockchain records to find which of them held or previously held funds. This is the identical adversary tradecraft used by real-world attackers: pre-generate the full reduced keyspace offline, derive candidate addresses for every supported chain, and continuously monitor those addresses on-chain so that any deposit can be swept within seconds to minutes of confirmation.
On 2026-05-27, a coordinated, automated sweep operation drained approximately $3,140,968 from 431 of the exposed wallets in a single wave: ~$2.57 million in Bitcoin (a single BTC address alone lost over $1.1 million), $285,778 in Ethereum, $177,225 in Rootstock, $80,970 in Tron, and $23,473 in Polygon. Draining activity did not stop there — over $5 million total has been moved from exposed wallets since that date, including an additional roughly $2 million swept on 2026-07-05, indicating persistent, likely automated monitoring/sweeping infrastructure watching the vulnerable address set for new deposits. As of 2026-06-30, Coinspect had identified 2,114 exposed addresses showing on-chain activity — a figure the firm stresses is only a partial view, since it depends on which vulnerable seed-generation algorithms and wallet apps have been reverse-engineered so far; the true number of affected wallets is likely much higher. Hardware wallets and current mainstream software wallets are confirmed not affected — risk is concentrated in older, niche, or discontinued mobile hot-wallet apps.
Coinspect has withheld the names of the specific vulnerable wallet applications and the precise entropy-reduction magnitude, following a staged/limited disclosure approach: technical details are being shared privately with affected wallet vendors while public information is deliberately restricted to slow follow-on exploitation by additional threat actors, even as the vulnerability is already under active, ongoing exploitation. Coinspect published a public checker tool at illbloom.org that compares user-supplied public addresses (never private keys or seed phrases) against Coinspect's dataset of known-vulnerable addresses with confirmed historical balances, across Bitcoin, Tron, Solana, and EVM-compatible chains.
Remediation is unusually strict for this vulnerability class: because the underlying entropy defect lives in the seed-generation code path itself, neither updating the vulnerable app nor re-importing the same recovery phrase into a different, non-vulnerable wallet remediates exposure — the original phrase is permanently compromised because its derivation space was never large enough to be secret. Affected users must generate an entirely new recovery phrase (ideally on a hardware device or an audited, mainstream software wallet using a proper CSPRNG) and migrate all fu
Weaknesses (CWE)
CWE-338, CWE-330, CWE-331
Target sectors: cryptocurrency, finance, fintech, consumer mobile applications
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1589, T1595, T1592.004, T1587.004, T1587.001, T1588.006, T1190, T1110.002, T1528, T1552.004