Image credit: Shutterstock
Blockchain security firm Coinspect has warned that thousands of crypto wallets may be exposed to Ill Bloom, a wallet-generation flaw tied to weak recovery phrases.
Coinspect said the flaw has already been exploited. It can let attackers recreate affected seed phrases and drain funds across several blockchains, making the risk broader than one wallet address or network.
Weak Randomness Exposed Recovery Phrases
Ill Bloom is linked to weak randomness used when some software wallets generated recovery phrases. Recovery phrases are supposed to be strong enough that attackers cannot guess them. Coinspect said some affected wallets were created in conditions that made the phrases weaker than they should have been.
The firm said hardware wallets are not affected based on the evidence available so far. It also said most current software wallets do not appear vulnerable, with the most likely affected products being less widely used mobile software wallets.
Coinspect has not published full technical details because the flaw is still being exploited. It said the staged disclosure is meant to help wallet teams and ecosystem participants protect users without giving attackers a clearer playbook.
May 27 Sweep Drained 431 Accounts
Coinspect’s analyzed address set contained 2,114 addresses across Bitcoin, Ethereum, Tron, Rootstock and Polygon as of June 30. The firm said 431 accounts were drained during a coordinated sweep on May 27, moving about $3.14 million.
Bitcoin accounted for most of the confirmed loss, with about $2.57 million drained on that chain. Total losses have since climbed to at least $5 million after another roughly $2 million moved from exposed wallets over the weekend.
Coinspect’s public analysis still treats the June 30 dataset as a lower bound because the investigation remains open.
Checker Covers EVM, Bitcoin, Tron and Solana
The exposure may extend beyond the first analyzed set. Coinspect’s public checker supports EVM, Bitcoin, Tron and Solana addresses, and the firm says more affected accounts continue to be identified.
The checker lets users see whether a public address appears in Coinspect’s dataset of known vulnerable funded wallets.
Coinspect warned users never to enter a recovery phrase, private key, password or wallet backup file into any checker. Only public wallet addresses should be used.
New Wallets Are Needed for Exposed Seeds
If an address matches, Coinspect says users should treat the seed as compromised. The safest step is to create a new wallet with a new recovery phrase and move funds to addresses from that wallet.
Updating a wallet app or importing the same recovery phrase into another app will not remove the risk. The affected phrase remains the weak point, even if the user changes software.
