Ill Bloom: How Bad Randomness Drained $5 Million From Crypto Wallets

Coinspect published something unusual in July: a public tool that lets anyone check whether their own wallet is already compromised. The firm calls the underlying flaw Ill Bloom. As of June 30, its dataset held 2,114 exposed addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon, and that figure only describes what Coinspect had confirmed by that date, not the ceiling. Coinspect's own FAQ lists a much longer roster of networks at risk overall - Solana, BNB Chain, Monad, Arbitrum, Gnosis, Optimism, Base, Avalanche, Linea, HyperEVM - because one compromised seed phrase reaches every chain it was ever used on.

Nobody hacked anything, strictly speaking. Attackers guessed seed phrases that were never random enough to guess.

What actually happened

A recovery phrase - twelve or twenty-four words - is supposed to come from a pool so large that guessing it is a fantasy. Not secret. Unguessable. That distinction is the entire security model of self-custody, and it only holds if the words were genuinely picked at random in the first place.

The wallets hit by Ill Bloom skipped that step. Some software used a weak random-number generator when it built the phrase, collapsing an astronomical search space into something a determined attacker could brute-force over time. Coinspect reconstructed the attack from scratch: generate every phrase the broken generator could output, derive the wallet address behind each one, then check which addresses still hold funds on-chain. What came out the other end wasn't a list of victims so much as a map of wallets compromised before their owners ever touched them.

On May 27, 2026, a coordinated sweep pulled $3,140,968 out of 431 of those wallets in a matter of hours. Coinspect's own analysis calls the signature behind it "the collector pattern" - dozens of unrelated addresses funneling their entire balances into the same small handful of destinations, all within a tight window. Bitcoin absorbed $2,573,522 of that total. One address alone lost more than $1.1 million in a single transaction. A second theft followed later: Coinspect told The Hacker News it had already flagged one owner's exposed seed and tried reaching them through the exchanges tied to that address, but the warning arrived too late. Another $2.1 million in USDT went missing from that same wallet.

Most of the exposure sits in older or lesser-known mobile apps and browser extensions, some dating back to 2018. Coinspect chose careful words for the next part, and it's worth repeating exactly: "Current evidence tells us that users that generated their seed with a hardware wallet are not affected," the firm said, adding that most current software wallets also don't appear vulnerable. Current evidence. Not a guarantee - the investigation is still open, and Coinspect says it has already found five vulnerable wallet implementations it isn't naming yet while vendor notification continues. That's also why there's no tidy list of "apps to avoid" today. Checking your own address is the only reliable move.

This keeps happening

Ill Bloom isn't a new category of bug wearing a fresh name.

2023 gave us Milk Sad, which let attackers drain wallets built with a popular Bitcoin command-line tool for the same underlying reason: predictable randomness at the moment of generation. A related flaw hit a widely used browser-extension wallet that same year and turned out to be crackable in under a day. Before either of those, Randstorm showed that Bitcoin wallets made between 2011 and 2015 through certain browser tools had keys that only looked random, until someone actually checked the math behind them.

There's no patch for a key that was weak from birth. Push a firmware update, roll out a security fix, audit the code twice over - none of it touches a phrase that already exists and was never truly random to begin with. The only real fix is starting over: a new wallet, a new phrase, and abandoning the old one for good.

Every protection layered on afterward, whether it's encryption or a firmware patch or an independent audit, assumes the underlying key was unpredictable the moment it came into existence. Skip that one step and the rest doesn't carry much weight.

Why software struggles here

Producing real entropy on a general-purpose device is harder than it sounds. Phones and laptops weren't built from the ground up to generate cryptographic-grade randomness on demand. A single shortcut in the implementation - a poorly seeded function, a reused entropy pool, a corner cut under deadline pressure - can quietly turn "impossible to guess" into "guessable over a weekend." Nobody notices until somebody goes looking, which is part of why some of these wallets sat exposed for years before this disclosure.

A dedicated hardware wallet sidesteps this particular failure mode by design. Instead of leaning on a phone's or laptop's general-purpose randomness, it runs a purpose-built hardware random number generator, physically walled off from everything else on the device.

ERA Wallet pushes this further than most implementations do. Key generation pulls from five entropy sources running at once. Two are hardware TRNGs - one inside the Secure Element, one inside the microcontroller. The other three come from the user, live: a camera capture, a swipe pattern across the screen, a shake of the device itself. None of it is cosmetic. Generate two wallets with different photos and different movements, and the private keys that come out are completely different every time - something you can test yourself in under a minute by creating two wallets side by side and comparing what you get.

One specific app didn't necessarily make one specific mistake somewhere. Key generation is the single step in the whole self-custody chain that can't be fixed after the fact. It happened correctly the instant the wallet came into existence, or it didn't.

If you're not sure your wallet is exposed

Anything created before 2020, especially a browser extension or an app from a smaller developer, is worth checking rather than worrying about blindly. Coinspect runs a free checker at illbloom.org that compares a public address against its dataset client-side. Nothing gets transmitted, and no secret ever needs to be entered anywhere. A match means treating the phrase as already burned, not merely "at risk" - move funds to a freshly generated wallet rather than waiting. A clean result doesn't guarantee safety forever either. Coinspect's dataset keeps growing as the investigation continues, and it says so plainly.

Self-custody depends on that first step working. Most people never think to ask about it until something like this makes the news.