[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-7AaXpBTK1zcofdyznYnZx-wjWAnoi1wX1A1Jc-sFDw":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":98},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"c05212ca-d4fe-4879-a39f-0aec1e1cae5b","Attackers Exploit 'Ill Bloom' Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets","attackers-exploit-ill-bloom-vulnerability-to-drain-3-1-million-from-cryptocurren-e7072c","Security firm Coinspect has disclosed a crypto wallet flaw it calls Ill Bloom, and attackers are already using it. The flaw is in how some wallet software generated its recovery phrase, the words that control the money. When that phrase is made with weak randomness, an attacker can work it out and take everything it controls. Coinspect has confirmed one coordinated sweep on May","A vulnerability dubbed 'Ill Bloom' in certain cryptocurrency wallet software allows attackers to guess recovery phrases generated with weak randomness, leading to the theft of funds. Coinspect identified a coordinated sweep on May 27 that drained $3.1 million from 431 wallets, with an additional $2 million potentially moved since then. The flaw primarily affects older or lesser-known mobile wallets, not hardware or mainstream software wallets.","Attackers exploit 'Ill Bloom' vulnerability in crypto wallets, stealing $3.1M.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fattackers-exploit-ill-bloom.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhAkED95MupJS7PoLW-VquW2mYDI869jXcCfUDUH240NRo4Yo_T63CRuicNBeGadfXW4MvDfie5vJqJ-bXkfD0VQPUl6_iUSR6C0csoL_JDjEeQmQGBoO9DDfdwzNpS8G4dendKvweGkYQypGPVx-_z0cQd_kmdVIA4YFRxNJiIwKpwU1wIUC5H8gnGDgg\u002Fs1600\u002Fcrypto-wallet.jpg","2026-07-10T09:00:05+00:00","2026-07-10T10:00:17.231973+00:00",9,[17,20],{"name":18,"type":19},"Ill Bloom","product",{"name":21,"type":22},"Coinspect","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":44,"vendors":97},[45,71],{"slug":46,"name":47,"problem":48,"products":49},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":67,"product_name":68,"url":69,"description":70},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"slug":72,"name":73,"problem":74,"products":75},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[76,83,89],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":72,"product_name":80,"url":81,"description":82},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":84,"product_name":85,"url":87,"description":88},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":99,"title":100,"body":101,"framework_refs":102,"framework_notes":112},"weak-randomness-in-crypto-wallets-enables-31m-recovery-phrase-attack","Weak Randomness in Crypto Wallets Enables $3.1M Recovery Phrase Attack","The 'Ill Bloom' vulnerability stems from insufficient entropy (weak randomness) during the generation of cryptocurrency wallet recovery phrases, making them mathematically guessable by attackers. This is a classic cryptographic implementation flaw where developers failed to use a cryptographically secure random number generator (CSPRNG), undermining the entire security model of the wallet. The coordinated, large-scale sweep of 431 wallets on a single day demonstrates that attackers actively scan for and exploit such weaknesses at scale once discovered. This matters because cryptocurrency transactions are irreversible — once funds are drained, recovery is effectively impossible, making prevention the only viable defense. Users of affected wallets face total financial loss with no recourse, underscoring the catastrophic consequences of poor cryptographic hygiene in financial software.",[103,104,105,106,107,108,109,110,111],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-90A: Recommendation for Random Number Generation Using Deterministic Random Bit Generators","NIST CSF DE.CM-8: Vulnerability Scans are Performed","NIST CSF PR.IP-12: A Vulnerability Management Plan is Developed and Implemented","NIST SP 800-57: Recommendation for Key Management","OWASP Cryptographic Failures (Top 10 A02:2021)","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (applicable where EU user financial data is involved)",{}]