{
 "tag": "ill-bloom",
 "name": "Ill Bloom",
 "group": "Other",
 "incidents": [
  {
   "slug": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "title": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026",
   "json": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana",
    "bitcoin",
    "ethereum",
    "polygon",
    "tron"
   ],
   "method": "key-leak",
   "product": "Seed phrases made by some less widely used mobile software wallets (2018 onward)",
   "tags": [
    "solana",
    "bitcoin",
    "ethereum",
    "polygon",
    "tron",
    "key-leak",
    "weak-randomness",
    "prng",
    "seed-phrase",
    "mobile-wallet",
    "coinspect",
    "ill-bloom"
   ],
   "amountUsd": 5000000,
   "victims": 431,
   "startedAt": "2026-05-27",
   "closedAt": "2026-07-06",
   "updatedAt": "2026-07-06T12:00:00Z",
   "summary": "Coinspect disclosed in July 2026 that some wallet software generated seed phrases with a weak random number generator, letting attackers guess the keys. On May 27, 2026, an attacker drained about $3.1 million from 431 of 2,114 vulnerable wallets in one address set, and about $2 million more moved later. That makes roughly $5 million known so far, across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Hardware-wallet seeds appear unaffected. Less widely used mobile software wallets are the likeliest source, with affected wallets dating back to 2018. Check older addresses with Coinspect's checker and move funds to a freshly generated wallet."
  }
 ],
 "changes": [
  {
   "incident": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-06",
   "title": "Coinspect warned publicly about the Ill Bloom flaw and released a wallet checker; about $2M more had moved from exposed wallets.",
   "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026"
  },
  {
   "incident": "ill-bloom-weak-seed-randomness-drains-may-2026",
   "incidentTitle": "'Ill Bloom' weak-randomness flaw lets attackers sweep about $5M from software-wallet seeds, Solana included",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-05-27",
   "title": "An attacker drained about $3.1M from 431 wallets whose seeds were generated with weak randomness.",
   "sourceUrl": "https://crypto.news/coinspect-warns-ill-bloom-flaw-may-drain-more-crypto-wallets/",
   "url": "https://drains.watch/i/ill-bloom-weak-seed-randomness-drains-may-2026"
  }
 ]
}