Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets

Summary: Coinspect disclosed a crypto wallet flaw it calls Ill Bloom, in which weak random-number generators used to create recovery phrases shrank the pool of possible phrases enough for attackers to search it. A coordinated sweep on May 27 drained about $3.1 million from 431 wallets, and a further $2.1 million in USDT was taken afterward, pushing confirmed losses past $5 million, with 2,114 exposed addresses traced as of June 30 across Bitcoin, Ethereum, Rootstock, Tron, and Polygon.
What you should know: Coinspect says the May 27 attacker skipped accounts holding less than about $5, but those seeds are compromised all the same, so anything deposited into them later can be taken - and the researchers call the losses a floor, not a ceiling, because the exposed set keeps growing as they find more vulnerable seed phrases.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026