Ill Bloom Leak Drains $3.1 Million From Crypto Wallets

Coinspect says weak recovery phrases on Bitcoin, Ethereum, and Solana were behind the attack, with self-custodial wallets and lesser-known mobile apps hit the hardest.

Key Takeaways

• Coinspect said the Ill Bloom leak was exploited on May 27, leading to losses of about $3.1 million across 431 wallets.
• The issue came from an insecure pseudorandom number generator that produced weak recovery phrases on multiple blockchains.
• Bitcoin saw the largest losses at $2.57 million; anyone who matches the affected dataset should set up a new wallet and move their funds.

Coinspect says a flaw in crypto wallets was exploited on May 27, draining about $3.1 million (€2.7 million) from 431 wallets. The so-called Ill Bloom leak left recovery phrases weak across several blockchains, which gave attackers a way to empty funded addresses. Self-custodial wallets were hit especially hard because users are responsible for managing their own private keys.

How the Leak Worked

According to Coinspect, the root problem was an insecure pseudorandom number generator used during wallet creation. That weakness meant some recovery phrases had much less cryptographic protection than they should have. In practice, that could let attackers recreate the full range of possible phrases and use them to reach wallets with balances.

The researchers say they were able to reproduce the attack from start to finish. They mapped out every address that could have been generated from the weak phrases and then checked those addresses against funded wallets on public blockchains. Coinspect says the affected addresses date back to 2018 and mostly came from lesser-known mobile crypto wallets.

Multiple Networks Affected

The vulnerability spans several chains, including Bitcoin, Ethereum, and Solana. Coinspect also points to a monitored set of 2,114 funded addresses on Bitcoin, Ethereum, Tron, Rootstock, and Polygon. On May 27, those accounts were drained within hours into a small group of shared collector addresses.

Bitcoin was the biggest target, with losses of $2.57 million (€2.3 million), and a single account lost more than $1.1 million (€1 million). Coinspect says the $3.1 million (€2.7 million) total should be treated as a floor, since more affected accounts are still being found. The case fits a wider pattern of weak randomness in crypto wallets, following earlier incidents such as Milk Sad and a vulnerability in the Trust Wallet browser extension. Recent hacks have also shown that the weak point is not always a smart contract; sometimes the problem is key management or wallet infrastructure, including private keys.

What Users Should Check Now

Coinspect has released a checker that compares public addresses with the known vulnerable dataset. Even so, a clean result does not prove a wallet is safe, since the dataset is still incomplete. Anyone who gets a match should create a brand-new crypto wallet and move funds to fresh addresses; reusing the old seed phrase would keep the money exposed.

For European crypto readers, the bigger takeaway is that wallet risk is not just about exchange failures or headline-grabbing hacks. It can start with something as basic as how keys are generated. Coinspect says hardware wallet users are not affected, while wallet developers are working on safer standards for Ethereum and beyond. More clarity on which apps produced the weak phrases should emerge over the next few days.