Attackers Exploit 'Ill Bloom' Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets
Attackers exploit 'Ill Bloom' vulnerability in crypto wallets, stealing $3.1M.
A vulnerability dubbed 'Ill Bloom' in certain cryptocurrency wallet software allows attackers to guess recovery phrases generated with weak randomness, leading to the theft of funds. Coinspect identified a coordinated sweep on May 27 that drained $3.1 million from 431 wallets, with an additional $2 million potentially moved since then. The flaw primarily affects older or lesser-known mobile wallets, not hardware or mainstream software wallets.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Coinspect?
Get an email when a new story names Coinspect, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe 'Ill Bloom' vulnerability stems from insufficient entropy (weak randomness) during the generation of cryptocurrency wallet recovery phrases, making them mathematically guessable by attackers. This is a classic cryptographic implementation flaw where developers failed to use a cryptographically secure random number generator (CSPRNG), undermining the entire security model of the wallet. The coordinated, large-scale sweep of 431 wallets on a single day demonstrates that attackers actively scan for and exploit such weaknesses at scale once discovered. This matters because cryptocurrency transactions are irreversible — once funds are drained, recovery is effectively impossible, making prevention the only viable defense. Users of affected wallets face total financial loss with no recourse, underscoring the catastrophic consequences of poor cryptographic hygiene in financial software.
What helps against this
How we list vendors- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.