Milk

Zodiac

Gnosis

Bloom

A wallet generation flaw dubbed “Ill Bloom” has left thousands of cryptocurrency addresses vulnerable to unauthorized access and fund drains across Bitcoin, Ethereum, Tron, and other networks.&nbsp; The issue stems from insecure pseudorandom number generation used in certain software wallets during the creation of recovery phrases, also known as seed phrases. This weakness reduces the cryptographic strength of the phrases far below standard expectations, allowing attackers to predict and regenerate them to control the associated wallets.
The vulnerability has affected wallets created as early as 2018, with coordinated drains observed as recently as late May and early July 2026. <a href="https://x.com/coinspect/status/2073935693189931274?s=20" rel="noopener noreferrer nofollow">Coinspect’s analysis</a> of one set of exposed addresses identified 2,114 vulnerable accounts with on-chain activity. On May 27, 2026, attackers drained 431 of these accounts for approximately $3.14 million. Additional thefts pushed total confirmed losses to around $5 million, with Bitcoin accounting for the largest share at over $2.5 million in the primary sweep. One Bitcoin account alone contributed more than $1.1 million to the haul. 
<blockquote class="twitter-tweet">
 Hundreds of accounts were drained of ~$3M on May 27, 2026. In the last few hours, another ~$2M was moved from exposed wallets.
 Thousands of accounts remain at risk across Bitcoin, Ethereum + L2s, Tron, and Solana.
 — Coinspect Security (@coinspect) <a href="https://x.com/coinspect/status/2073935693189931274?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 6, 2026</a>
</blockquote>
The incident adds to a growing list of wallet-related security failures across the crypto sector. In a separate case, a <a href="https://cryip.co/secondfi-wallet-vulnerability-drains-millions-in-cardano-assets/" rel="noopener noreferrer nofollow">SecondFi wallet vulnerability</a> reportedly led to millions in Cardano assets being drained, showing how wallet-level weaknesses can create serious risks even outside major chains.
<h2 id="technical-details-point-to-specific-wallet-software">Technical details point to specific wallet software.</h2>
The flaw primarily impacts lesser-known mobile software wallets rather than hardware wallets or major current software applications. Hardware wallet users appear unaffected, and most modern software wallets have stronger randomness implementations.
The firm reproduced the attack vector end-to-end using public blockchain data and released a public checker tool at <a href="https://illbloom.org/" rel="noopener noreferrer nofollow">illbloom.org</a>. Users can input a public wallet address to determine if it matches known vulnerable sets. The tool explicitly warns against entering seed phrases or private keys.
<h2 id="attack-patterns-show-coordinated-sweeping">Attack patterns show coordinated sweeping.</h2>
<a href="https://illbloom.org/articles/chain-analysis/" rel="noopener noreferrer nofollow">Ill Bloom On-chain data</a> reveals a clear sweep on May 27, with many unrelated accounts sending nearly all their funds to a small number of collector addresses, predominantly on Ethereum. Funds moved quickly, often within hours. Similar patterns emerged in recent days, indicating the campaign remains active.
Affected addresses showed first funding dates stretching back to September 2018, with new vulnerable wallets still receiving funds into 2026. Peak exposure for the analyzed set reached about $12.56 million in April 2022, though actual stolen amounts are lower due to market fluctuations and incomplete data.
The case also comes after other security incidents involving wallet infrastructure and transaction controls. In one <a href="https://cryip.co/gnosis-pay-hack-exposes-zodiac-delay-module-vulnerability-users-assured-full-reimbursement/" rel="noopener noreferrer nofollow">Gnosis Pay-related exploit</a>, attackers abused a Zodiac Delay Module vulnerability, although users were later assured full reimbursement. Such incidents show that risks can emerge not only from seed generation, but also from smart contract permissions and wallet-management modules.
<h2 id="historical-parallels-and-broader-implications">Historical parallels and broader implications.</h2>
This is not the first time weak randomness in wallet software has led to losses. Past incidents include the Milk Sad vulnerability and issues in the <a href="https://cryip.co/trust-wallet-7m-hack-exposed-after-internal-dispute-at-chinese-firm/" rel="noopener noreferrer nofollow">Trust Wallet</a> browser extension, which was patched before significant thefts occurred. Ill Bloom highlights persistent risks in seed phrase generation, particularly for users of older or niche applications.
The incident underscores challenges in self-custody, where users bear full responsibility for key management. Drained funds are typically irrecoverable once moved through mixers or bridges.
Recent wallet-drain cases have also shown that users can lose assets even when they believe they have not directly approved a malicious transaction. In another reported case, a crypto holder lost about $2.3 million in <a href="https://cryip.co/crypto-holder-loses-2-3-million-ada-ledger-wallet-without-signing-transaction/" rel="noopener noreferrer nofollow">ADA from a Ledger wallet</a> without signing a transaction, further raising concerns over how users understand wallet security, approvals, recovery phrases and device safety.
&nbsp;

Ill Bloom Vulnerability Puts Thousands of Crypto Wallets at Risk

Table of Contents

CRYIP

Other articles published on Jul 6, 2026

Join our free newsletter for daily crypto updates!