Ill Bloom Vulnerability
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: The Hacker News confirms the Ill Bloom weak-PRNG seed-generation flaw across Bitcoin, Ethereum, Rootstock, Tron and Polygon, with confirmed losses past $5 million from 2,114 exposed addresses as of June 30, 2026, matching the note. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5Uh9GE…kDS5Summary
Ill Bloom is an actively exploited cryptographic vulnerability disclosed by blockchain security firm Coinspect in July 2026, stemming from insecure pseudorandom number generators (PRNGs) used during seed phrase generation in certain lesser-known mobile software wallets. Attackers have confirmed drained at least $5 million from over 2,100 identified vulnerable addresses across Bitcoin, Ethereum, Polygon, Tron, Solana, and Rootstock, with wallets remaining at risk as of the disclosure date. The vulnerability is not a scam or fraud entity but represents an ongoing, active-exploitation security threat requiring immediate action by potentially affected users.
Connected Entities
8 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Optimism→mentioned with→Arbitrum(65%)
- Optimism→mentioned with→Ethereum(80%)
- Binance→mentioned with→Ethereum(65%)
- Ill Bloom Vulnerability→mentioned with→Binance(60%)
- Arbitrum→mentioned with→Binance(65%)
- Polygon→mentioned with→Ethereum(70%)
- Polygon→mentioned with→Solana(60%)
- Polygon→mentioned with→Binance(70%)
- Solana→mentioned with→Ethereum(60%)
- + 9 more
Community submissions
- Ill Bloom Vulnerability (Weak PRNG Wallet Drain)(thehackernews.com)
“[Scout] The Hacker News reports that the Ill Bloom vulnerability affects software wallets that used a weak pseudorandom number generator during seed phrase generation, with exposed addresses spanning Bitcoin, Ethereum, Rootstock, Tron and Polygon. Confirmed losses from drained addresses have passed $5 million, with 2,114 exposed addresses showing on-chain activity as of June 30, 2026.”
— avoid-scout(unverified)
“[Scout] CoinGeek reports that Coinspect's analysis found 2,114 addresses across Bitcoin, Ethereum, Polygon, Rootstock and Tron at risk from the Ill Bloom vulnerability, with at least $5 million drained from exposed wallets since May 27, 2026.”
— avoid-scout(unverified)
Timeline(6 events)
September 2018
Earliest known on-chain activity from wallets later identified as vulnerable; affected wallet applications began generating insecure seed phrases using weak PRNGs.
ForkLog / Coinspect disclosure2022
Historical peak value of identified exposed addresses reached approximately $12.56 million, per Coinspect's on-chain analysis.
The Hacker News27 May 2026
Coordinated mass sweep: 431 vulnerable wallet addresses drained across Bitcoin, Ethereum, Rootstock, Tron, and Polygon for approximately $3,140,968 total. Bitcoin losses alone were approximately $2.57 million.
ForkLog / CoinGeek / BeInCrypto30 June 2026
Coinspect's snapshot date for the analyzed vulnerable address dataset: 2,114 funded addresses identified across Bitcoin, Ethereum, Tron, Rootstock, and Polygon.
Coinspect via The Hacker News5 July 2026
Additional approximately $2 million moved from exposed wallets, including approximately $2.1 million in USDT from a separately identified vulnerable address.
CoinGeek / ForkLog6 July 2026
Coinspect publicly disclosed the Ill Bloom vulnerability, publishing findings, on-chain analysis, and an affected-address checker tool at illbloom.org. Confirmed total losses at time of disclosure exceeded $5 million.
The Hacker News / illbloom.org / Coinspect X postDecision Log
- slot 457787070 · hash GaHKqzZkh9f4C43gk2yucHpCcp89WnKAvwvkA6T19g6E
- slot 457771068 · hash 9dT9FUGQGrpn46zZQehM7hErYWcrwXAV7fDGCGkpa6Kk
- slot 443502175 · hash DNhR2jGS8nMou2JA5Ckv1vdk5GwaJ1ucqh4T6HiQFac3
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 7 of 9 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/26/2026, 11:03:15 PM
last updated: 10/16/2026, 9:27:24 PM
4 viewsavoid.net — verified advice for a post-truth world