{
 "slug": "ill-bloom-weak-seed-randomness-drains-may-2026",
 "title": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
 "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026",
 "json": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "solana",
  "bitcoin",
  "ethereum",
  "polygon",
  "tron"
 ],
 "method": "key-leak",
 "product": "Seed phrases made by some less widely used mobile software wallets (2018 onward)",
 "tags": [
  "solana",
  "bitcoin",
  "ethereum",
  "polygon",
  "tron",
  "key-leak",
  "weak-randomness",
  "prng",
  "seed-phrase",
  "mobile-wallet",
  "coinspect",
  "ill-bloom"
 ],
 "amountUsd": 5000000,
 "victims": 431,
 "startedAt": "2026-05-27",
 "closedAt": "2026-07-06",
 "updatedAt": "2026-07-06T12:00:00Z",
 "summary": "Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet.",
 "timeline": [
  {
   "date": "2026-05-27",
   "title": "An attacker drained about $3.1M from 431 wallets whose seeds were generated with weak randomness.",
   "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/"
  },
  {
   "date": "2026-07-06",
   "title": "Coinspect warned publicly about the Ill Bloom flaw and released a wallet checker; about $2M more had moved from exposed wallets.",
   "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Coinspect warns Ill Bloom flaw may drain more crypto wallets",
   "url": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/",
   "publisher": "crypto.news",
   "date": "2026-07-06"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou may be affected if your seed phrase was created by a mobile software wallet, especially an older or less widely used app, at any time since 2018. Seeds made on hardware wallets appear safe. Run your public addresses (never your seed) through Coinspect's official Ill Bloom checker, found via Coinspect's own site.\n\n## What to do now\n- If an address is flagged, or funds left without your approval, create a new wallet with a hardware wallet or a widely used, maintained app and move everything.\n- Don't reuse the old seed on any chain. One weak seed exposes every chain derived from it.\n- Never paste your seed phrase into any 'checker'. A legitimate check only needs public addresses.\n\n## How to avoid this\n- Generate seeds on a hardware wallet for anything you can't afford to lose.\n- Retire wallets created years ago in niche apps.\n- Watch vendor and Coinspect updates; the flaw was still being exploited when it was disclosed.",
 "notes": null,
 "agentBrief": "# 'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included\n\n- Severity: Critical · Status: Still active (past)\n- Chains: Solana, Bitcoin, Ethereum, Polygon, Tron · Method: Leaked private keys and seed phrases\n- Started: May 27, 2026 · Last update: Jul 6, 2026 · Reported stolen: $5.0M · Victims: 431\n- Who/what: Seed phrases made by some less widely used mobile software wallets (2018 onward)\n\nCoinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet.\n\n## Am I affected?\nYou may be affected if your seed phrase was created by a mobile software wallet, especially an older or less widely used app, at any time since 2018. Seeds made on hardware wallets appear safe. Run your public addresses (never your seed) through Coinspect's official Ill Bloom checker, found via Coinspect's own site.\n\n## What to do now\n- If an address is flagged, or funds left without your approval, create a new wallet with a hardware wallet or a widely used, maintained app and move everything.\n- Don't reuse the old seed on any chain. One weak seed exposes every chain derived from it.\n- Never paste your seed phrase into any 'checker'. A legitimate check only needs public addresses.\n\n## How to avoid this\n- Generate seeds on a hardware wallet for anything you can't afford to lose.\n- Retire wallets created years ago in niche apps.\n- Watch vendor and Coinspect updates; the flaw was still being exploited when it was disclosed.\n\n## Sources\n- Coinspect warns Ill Bloom flaw may drain more crypto wallets (crypto.news, 2026-07-06): https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/\n\nFull record: https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026 · JSON: https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}