# 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto Wallets Actively Exploited to Drain $3.1M+

> Security firm Coinspect disclosed 'Ill Bloom', a critical vulnerability in older/lesser-known mobile cryptocurrency wallet apps (some dating to 2018) caused by an insecure pseudo-random number generator (PRNG) used during recovery-phrase generation, drastically shrinking the seed-phrase search space and letting attackers pre-compute vulnerable wallets and drain them the moment funds arrive. A coordinated sweep on 2026-05-27 drained roughly $3.14 million from 431 wallets across Bitcoin, Ethereum, Rootstock, Tron, and Polygon; over $5 million has been moved from exposed wallets in total since, including a further ~$2 million on 2026-07-05, with 2,114 exposed addresses showing on-chain activity identified as of 2026-06-30.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1170
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-ill-bloom-wallet-prng-flaw-tl-2026-1170.webp?v=9ad878d3 (Threadlinqs threat intel: CVE-2023-31290 Ill Bloom Wallet Drains: Detection & IOCs (TL-2026-1170) — Critical severity, 23 IOCs, 9 detection rules.)
- **ID:** TL-2026-1170
- **Severity:** CRITICAL (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 23
- **CVEs:** CVE-2023-31290, CVE-2023-39910

## Description

Coinspect, an Argentina-based blockchain security firm, disclosed a vulnerability class dubbed 'Ill Bloom' affecting recovery-phrase (BIP-39 mnemonic) generation in a subset of older and lesser-known mobile cryptocurrency wallet applications, some in circulation since 2018. The root cause is the wallet software's use of a weak, non-cryptographically-secure PRNG (rather than a CSPRNG) when generating entropy for new recovery phrases. This mirrors the well-documented pattern seen in the 2023 'Milk Sad' (Libbitcoin Explorer, CVE-2023-39910) and Trust Wallet browser extension (CVE-2023-31290) incidents, where a Mersenne Twister (mt19937) PRNG seeded with a low-entropy value (e.g., 32-bit system time) collapsed the theoretical 2^256 seed-phrase keyspace down to a brute-forceable ~2^32 (roughly 4.3 billion) possibilities.

Coinspect reconstructed the weak generator's output space, derived every wallet address the flawed algorithm could produce across Bitcoin, Ethereum, Rootstock, Tron, Polygon, Solana, BNB Chain, Monad, Arbitrum, Gnosis, Optimism, Base, Avalanche, Linea, and HyperEVM (all EVM-compatible or otherwise derivable from the same seed material), and cross-referenced the resulting address set against public blockchain records to find which of them held or previously held funds. This is the identical adversary tradecraft used by real-world attackers: pre-generate the full reduced keyspace offline, derive candidate addresses for every supported chain, and continuously monitor those addresses on-chain so that any deposit can be swept within seconds to minutes of confirmation.

On 2026-05-27, a coordinated, automated sweep operation drained approximately $3,140,968 from 431 of the exposed wallets in a single wave: ~$2.57 million in Bitcoin (a single BTC address alone lost over $1.1 million), $285,778 in Ethereum, $177,225 in Rootstock, $80,970 in Tron, and $23,473 in Polygon. Draining activity did not stop there — over $5 million total has been moved from exposed wallets since that date, including an additional roughly $2 million swept on 2026-07-05, indicating persistent, likely automated monitoring/sweeping infrastructure watching the vulnerable address set for new deposits. As of 2026-06-30, Coinspect had identified 2,114 exposed addresses showing on-chain activity — a figure the firm stresses is only a partial view, since it depends on which vulnerable seed-generation algorithms and wallet apps have been reverse-engineered so far; the true number of affected wallets is likely much higher. Hardware wallets and current mainstream software wallets are confirmed not affected — risk is concentrated in older, niche, or discontinued mobile hot-wallet apps.

Coinspect has withheld the names of the specific vulnerable wallet applications and the precise entropy-reduction magnitude, following a staged/limited disclosure approach: technical details are being shared privately with affected wallet vendors while public information is deliberately restricted to slow follow-on exploitation by additional threat actors, even as the vulnerability is already under active, ongoing exploitation. Coinspect published a public checker tool at illbloom.org that compares user-supplied public addresses (never private keys or seed phrases) against Coinspect's dataset of known-vulnerable addresses with confirmed historical balances, across Bitcoin, Tron, Solana, and EVM-compatible chains.

Remediation is unusually strict for this vulnerability class: because the underlying entropy defect lives in the seed-generation code path itself, neither updating the vulnerable app nor re-importing the same recovery phrase into a different, non-vulnerable wallet remediates exposure — the original phrase is permanently compromised because its derivation space was never large enough to be secret. Affected users must generate an entirely new recovery phrase (ideally on a hardware device or an audited, mainstream software wallet using a proper CSPRNG) and migrate all funds to fresh addresses derived from that new phrase.

This is the third major disclosed incident in a recurring pattern of weak-RNG seed-generation flaws in cryptocurrency wallet software, following Milk Sad (Libbitcoin Explorer 'bx seed', CVE-2023-39910, disclosed August 2023, mt19937 seeded with 32-bit system time, over 227,200 Bitcoin wallets historically at risk, actively exploited June-July 2023) and the Trust Wallet browser extension flaw (CVE-2023-31290, disclosed 2023, Trust Wallet Core before 3.1.1 / extension before 0.0.183, also a 32-bit mt19937 seed, exploited in the wild December 2022 and March 2023 with over $6 million stolen), as well as the older 'Randstorm' class of JavaScript CSPRNG weaknesses in browser-based wallets generated between 2011-2015. No CVE has been assigned to the Ill Bloom vulnerability class as of publication, and no CVSS score has been published by Coinspect; this record uses a CRITICAL qualitative severity and a CVSS 3.1 base score aligned to the closely analogous CWE-338 precedent (CVE-2023-39910), reflecting the demonstrated, low-complexity, unauthenticated, actively-exploited fund-theft impact.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1595 Active Scanning
- T1592.004 Client Configurations
- T1587.004 Exploits
- T1587.001 Malware
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1110.002 Password Cracking
- T1528 Steal Application Access Token
- T1552.004 Private Keys
- T1580 Cloud Infrastructure Discovery
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1657 Financial Theft
- T1531 Account Access Removal

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Weak-PRNG Wallet Seed/Mnemonic Generation (Ill Bloom / CWE-338 Pattern) — SPL** (`TL-2026-1170-SPL-001`)

Detects a process invoking a non-cryptographic PRNG API (PowerShell Get-Random, .NET System.Random, or a scripting-language random module) in the same execution context as file writes named for seed/mnemonic/recovery material. This is the exploitation-stage artifact of the Ill Bloom class of vulnerabilities, where wallet software derives BIP-39 recovery phrases from a low-entropy, non-CSPRNG source instead of an OS CSPRNG.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1552.004, T1587.004
- **Data sources:** sysmon, windows_security
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(CommandLine, "(?i)get-random|system\.random")
| join type=inner ProcessGuid
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      | where match(TargetFilename, "(?i)seed|mnemonic|recovery")
      | fields ProcessGuid, TargetFilename ]
| table _time, ComputerName, User, Image, CommandLine, TargetFilename, ProcessGuid
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("Get-Random", "System.Random")
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName has_any ("seed", "mnemonic", "recovery")
) on $left.DeviceId == $right.DeviceId, $left.InitiatingProcessId == $right.InitiatingProcessId
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
```

### Sigma

```yaml
title: Weak PRNG Usage Pattern in Wallet-Style Entropy Generation (Ill Bloom / CWE-338 Class)
id: 8f3d6f6a-1170-4a1c-9f0a-illbloom001
status: experimental
description: Detects a process invoking a non-cryptographic PRNG API together with file writes named for seed/mnemonic/recovery material, consistent with the Ill Bloom / Milk Sad weak-entropy wallet-key-generation flaw.
references:
    - https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html
    - https://illbloom.org/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39910
author: Threadlinqs Team
date: 2026-07-10
tags:
    - attack.credential-access
    - attack.t1552.004
    - attack.resource-development
    - attack.t1587.004
    - cve.2023.39910
logsource:
    category: process_creation
    product: windows
detection:
    selection_process:
        Image|endswith:
            - '\\powershell.exe'
            - '\\pwsh.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'Get-Random'
            - 'System.Random'
    selection_output:
        CommandLine|contains:
            - 'seed'
            - 'mnemonic'
            - 'recovery'
    condition: selection_process and selection_cmdline and selection_output
falsepositives:
    - Legitimate developer testing of PRNG APIs unrelated to wallet software
    - Non-cryptographic randomness used intentionally for non-secret purposes (e.g. UI shuffling)
level: high
```

**Known false positives:**

- Legitimate developer or QA testing of PRNG APIs unrelated to wallet key generation
- Games or UI code intentionally using non-cryptographic randomness for non-secret purposes

**Tuning notes:** Scope the join window tighter (e.g. same-process, <5s) to reduce noise from unrelated PowerShell sessions; add an allow-list for known dev/test hosts running wallet software unit tests.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Wallet Recovery-Phrase Generation via Non-CSPRNG API — KQL (locked: unlock with TL Creds)
- Offline Reduced-Keyspace Brute-Force Candidate Enumeration — KQL (locked: unlock with TL Creds)
- Automated Multi-Chain Sweep-Transfer Command Following Balance-Poll — KQL (locked: unlock with TL Creds)
- Weak PRNG Usage Pattern in Wallet-Style Entropy Generation (Ill Bloom / CWE-338 Class) — Sigma (locked: unlock with TL Creds)
- Deterministic Weak-PRNG Replay / Reduced-Keyspace Enumeration — Sigma (locked: unlock with TL Creds)
- Automated Address-Monitoring / Fund-Sweep Loop Pattern (Ill Bloom-Style) — Sigma (locked: unlock with TL Creds)
- Sequential Low-Entropy Seed Brute-Force / Keyspace Sweep — SPL (locked: unlock with TL Creds)
- Automated Address-Monitoring / Fund-Sweep Loop (Ill Bloom Sweep Pattern) — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Attackers Exploit 'Ill Bloom' Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets](https://thehackernews.com/2026/07/attackers-exploit-ill-bloom.html)
- [Ill Bloom: Crypto Wallet Vulnerability (checker + disclosure)](https://illbloom.org/)
- [Coinspect Warns of Vulnerability Threatening Thousands of Crypto Wallets](https://forklog.com/en/coinspect-warns-of-vulnerability-threatening-thousands-of-crypto-wallets/)
- ['Ill Bloom' flaw puts 2,114 digital wallets at risk: report](https://coingeek.com/ill-bloom-flaw-puts-2114-digital-wallets-at-risk-report/)
- [Crypto Wallets Lose $5M to Broken Random Number Generator: Ill Bloom Disclosure](https://www.techtimes.com/articles/319796/20260706/crypto-wallets-lose-5m-broken-random-number-generator-ill-bloom-disclosure.htm)
- [Ill Bloom Vulnerability Drains $3.1 Million From Crypto Wallets: Are You Exposed?](https://beincrypto.com/ill-bloom-vulnerability-crypto-wallets/)
- [Crypto Wallet Vulnerability Exposes Bitcoin, Ethereum, Solana Users](https://www.mexc.com/news/1196973)
- [Coinspect warns Ill Bloom flaw may drain more crypto wallets](https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/)
- [Coinspect Warns Thousands of Wallets Vulnerable to Ill Bloom](https://cointelegraph.com/news/thousands-of-crypto-wallets-at-risk-from-ill-bloom-vulnerability-coinspect)
- [Coinspect Warns Ill Bloom Wallet Flaw Puts Thousands at Risk](https://www.coininsider.com/news/coinspect-warns-ill-bloom-wallet-flaw-puts-thousands-at-risk/)
- [CVE-2023-39910 Detail (Milk Sad / Libbitcoin Explorer)](https://nvd.nist.gov/vuln/detail/CVE-2023-39910)
- [Milk Sad — Technical write-up for CVE-2023-39910](https://milksad.info/disclosure.html)
- [CVE-2023-31290: Trust Wallet Core Fund Theft Vulnerability](https://www.clouddefense.ai/cve/2023/CVE-2023-31290)
- [Funds of Every Wallet Created With The Trust Wallet Browser Extension Could Have Been Stolen Without Any User Interaction](https://www.ledger.com/blog/funds-of-every-wallet-created-with-the-trust-wallet-browser-extension-could-have-been-stolen)
- [Trust Wallet Core before 3.1.1 GitHub Security Advisory](https://github.com/advisories/GHSA-pm4f-pggw-8jwc)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1170