Ill Bloom flaw steals $5 million from crypto wallets

A critical security vulnerability affecting the recovery phrase generation of certain cryptocurrency software wallets has led to the theft of at least $5 million and continues to pose a widespread risk. The flaw, named "Ill Bloom" by blockchain security firm Coinspect, stems from weak pseudorandom number generation used during wallet creation, making seed phrases predictable and susceptible to brute-force attacks.

The vulnerability impacts wallets across multiple major blockchains, including Bitcoin, Ethereum, Polygon, Rootstock, Tron, and Solana. According to Coinspect, the underlying weakness has existed since at least 2018, and wallets with the flaw were still being created as recently as several weeks ago. The firm estimates that thousands of wallets remain exposed.

Exploitation of the flaw began with a coordinated attack on May 27, which drained approximately $3.1 million from 431 out of a reviewed set of 2,114 vulnerable wallets. A second wave of thefts occurred on Sunday, July 5, moving another $2 million from compromised addresses, bringing confirmed losses to at least $5 million. Coinspect cautioned that the actual total is likely higher, as its analysis may not cover...