Crypto wallets at risk: $5M stolen in 'Ill Bloom' flaw

The “Ill Bloom” flaw exposes thousands of crypto wallets to theft by exploiting weak recovery phrases. Attackers have stolen about $5 million, and wallets on major blockchains remain at risk.

A critical vulnerability known as “Ill Bloom” is threatening thousands of crypto wallets across major blockchains, including Bitcoin, Ethereum, Tron, Solana, Polygon, and Rootstock. This flaw arises from weak recovery phrase generation caused by insecure or faulty random number generators in certain software wallets. As a result, attackers can predict wallet seed phrases and gain unauthorized access to funds. Since 2018, this vulnerability has enabled attackers to steal approximately $5 million from hundreds of accounts, with recent incidents leading to millions more being drained. The issue is not limited to a single wallet provider, highlighting a widespread systemic risk across the crypto ecosystem. Security firms have released tools to help users check if their wallets are affected and are urging wallet providers to implement features that detect weak mnemonic phrases. The ongoing threat has raised concerns about crypto security and is influencing market perceptions of risk in 2026.