Coinspect has warned that thousands of crypto wallets may be at risk because of weak recovery phrase generation. The security firm named the issue “Ill Bloom” and said it affects wallets created across Bitcoin, Ethereum, Polygon, Rootstock, Tron and Solana. Summary Coinspect says weak recovery phrase generation has exposed wallets across several major blockchains since 2018. About $5 million has already moved from exposed wallets, including fresh transfers on Sunday. Hardware wallet users appear unaffected so far, while lesser-known mobile wallet users face higher risk. The issue comes from weak randomness during wallet creation. In simple terms, some wallets may have used a poor number generator when creating seed phrases. That can make private keys easier to guess than they should be. Coinspect said, “If funds recently moved without your permission, this vulnerability may be why.” The firm has released a wallet-checking tool so users can test whether their addresses may be exposed. 吴说获悉，Coinspect Security 发布 Ill Bloom 钱包弱随机性风险的首批调查结果，包括受影响地址检查工具和链上分析。Coinspect 称，弱钱包生成问题自 2018 年以来已影响多条链用户，且受影响钱包最近几周仍在生成；该问题并非源自单一软件钱包。5 月 27 日，数百个账户约 300…— 吴说区块链 (@wublockchain12) July 6, 2026 The company said the problem has affected wallets generated as early as 2018. It also said vulnerable wallets were still being created in recent weeks, meaning the issue may not come from one single wallet app. At least $5M has moved from exposed wallets Coinspect’s early findings show that an attack on May 27 drained about $3.1 million from 431 wallets out of 2,114 vulnerable accounts in one reviewed address set. Another $2 million moved from exposed wallets on Sunday. That brings the known amount moved from exposed wallets to about $5 million. Coinspect said the real figure may be higher because the analysis may not cover every chain or address tied to the same weak generation pattern. SlowMist also said it was tracking the alert. The security firm posted, “We’re closely monitoring the Ill Bloom wallet weak randomness risk alert from Coinspect,” and advised users to check older wallet addresses. The warning comes as crypto security firms continue to track wallet-level risks. Crypto.news recently reported that SlowMist flagged a flaw that could lead to private key leakage in a widely used encryption library. Mobile software wallets face closer review Coinspect said current evidence shows users who generated their seed with a hardware wallet are not affected. It also said most current software wallets do not appear to be vulnerable based on available research. The firm said the strongest candidates are users who generated seeds in less widely used mobile software wallets. That means users who created older wallets on smaller mobile apps may face more risk than those using hardware wallets. The finding fits a wider pattern in wallet security. Crypto.news reported in 2023 that the Randstorm vulnerability exposed BitcoinJS-built wallets after weak random number generation left large amounts of crypto at risk. Crypto.news also reported in March that a MediaTek chip flaw exposed crypto wallet seed phrases on some Android phones. That case showed how device security and wallet security can overlap. Users urged to check old addresses Coinspect has not published full exploit details because the risk remains active. That decision limits information for attackers while giving users a way to check whether their addresses may be affected. Users with exposed wallets should consider moving funds to a newly generated wallet created through trusted software or a hardware wallet. They should not reuse an old seed phrase that may have weak randomness.The Ill Bloom case also shows why seed phrase quality matters. A wallet can look normal, hold assets, and work across chains while still carrying a hidden flaw from the moment it was created. Crypto.news has also covered phishing risks where scammers try to steal seed phrases directly. In February 2025, Scam Sniffer warned that fake Phantom Wallet pop-ups were used to steal seed phrases, showing that users face both technical and social attack paths.
