- Published on
Thousands of crypto wallets at risk from 'Ill Bloom' vulnerability
- Authors
- Name
- DeepHorus
Thousands of crypto wallets across multiple blockchains are at risk of being drained due to a vulnerability dubbed "Ill Bloom," according to blockchain security firm Coinspect. The exploit stems from weaker-than-intended recovery phrases generated by certain software wallets, spanning Bitcoin, Ethereum, Polygon, Rootstock, Tron, and Solana. Coinspect disclosed the issue on Sunday, warning that funds may have been moved without permission due to weak randomness in pseudorandom number generators during phrase generation.
The vulnerability has impacted wallets created as early as 2018, with a particular prevalence in lesser-known mobile software wallets. At least $5 million has been stolen from exposed wallets since May 27, including a single attack on that date that drained $3.1 million from 431 out of 2,114 vulnerable wallets. An additional $2 million was moved from exposed wallets on Sunday, though the total number of wallets at risk may be much higher as exploits on other networks and addresses remain unconfirmed.
Coinspect emphasized that hardware wallets and most current software wallets are not affected. The firm stated that "current evidence tells us that users that generated their seed with a hardware wallet are not affected," and noted that most modern software wallets also remain secure. The strongest candidates for vulnerability are users who generated their seed in less widely used mobile software wallets. Coinspect has released a wallet-checking tool for users to determine if their address is potentially exposed, while withholding details of the active exploit to prevent further attacks.
The blockchain security community has taken note of the threat. SlowMist, another security firm, posted on X that it is "closely monitoring the Ill Bloom wallet weak randomness risk alert from Coinspect." This vulnerability echoes previous incidents, such as in 2023 when Ledger's security team discovered a flaw in Trust Wallet's browser extension that limited mnemonic combinations to roughly four billion, allowing brute-force attacks. Trust Wallet patched the bug before any funds were stolen. Similarly, in the same year, a vulnerability in the Libbitcoin Explorer wallet led to $900,000 in crypto being stolen through private key brute forcing.
The Ill Bloom vulnerability underscores ongoing risks in crypto wallet security, particularly for users of outdated or less popular software. Coinspect's warning serves as a critical reminder for individuals to verify their wallet generation methods and consider migrating to hardware wallets or well-audited software alternatives. As the firm continues to monitor the situation, affected users are urged to use the checking tool and take immediate action to secure their funds. The incident also highlights the need for stronger randomness standards in wallet generation protocols to prevent future exploits.
