Ill Bloom Flaw May Drain More Crypto Wallets After $5M Heist

Coinspect warned this week that thousands of crypto wallets could still be vulnerable to the "Ill Bloom" weakness in seed phrase generation. The security firm said the flaw stems from poor randomness during wallet creation on mobile software apps, making private keys easier to guess than they should be.

The known damage so far: $3.1 million drained from 431 wallets on May 27 out of 2,114 vulnerable addresses Coinspect reviewed. Another $2 million moved from exposed wallets the following Sunday. That brings the tracked total to about $5 million. Coinspect said the real number is likely higher because the analysis has not covered every chain or address set tied to the same weak generation pattern.

The firm released a wallet-checking tool so users can test whether their addresses may be exposed. SlowMist is also tracking the alert. The security firm posted that it is closely monitoring the risk and advised users to check older wallet addresses.

Why Mobile Software Wallets Are the Prime Target

Coinspect said current evidence shows users who generated their seed with a hardware wallet are not affected. Most current software wallets also appear safe. The strongest candidates are users who generated seeds in less widely used mobile software wallets, especially those created before 2024.

A hardware wallet uses a dedicated secure element to generate randomness. Mobile software wallets, particularly from smaller developers, sometimes rely on the device's built-in random number generator. On some phones that generator can produce predictable sequences. The same seed phrase reused across apps does not fix the problem – the weak entropy is baked in from the moment the wallet was created.