Ill Bloom: A Wallet Bug Made Keys Guessable, and Thieves Took $5.7M

On 27 May 2026, in a single sweep, someone emptied 431 crypto wallets belonging to people who had never met, never shared a password and never clicked a bad link. The haul was about $3.14 million. Bitcoin made up about $2.57 million of it, and one bitcoin wallet alone gave up more than $1.1 million. Nobody had broken into anything. The thief had simply worked out the owners' keys.

Over the next seven weeks the same trick took another $2.55 million. A third, smaller sweep on 20 and 21 July took about $40,000 more. The total traced so far is at least $5.69 million, according to Coinspect, the Argentine security firm that found the flaw and named it Ill Bloom. Coinspect calls that figure a floor, not a final count.

A master key that was never random

A crypto wallet is controlled by a recovery phrase of 12 to 24 ordinary words, which works like the master key to a safe deposit box. Whoever has the words has the money. The whole system rests on one assumption: the words are chosen so randomly, from so many possibilities, that nobody could ever guess them. A properly made 12-word phrase is one of about 340 trillion trillion trillion possible combinations. That is far more than the number of grains of sand on Earth, many times over.

To pick those words, wallet apps ask the computer for random numbers. Most use a generator built for security, designed so that nobody can predict what it will produce next. The wallets caught by Ill Bloom relied on a function inside CryptoJS, a free library of encryption code that thousands of programs borrow, the way carmakers buy the same brake parts from one supplier. In June 2014 a change was made to that function after a programmer complained on GitHub, the site where such code is shared, that it was "not random enough". The change did not make it random enough.

The numbers it produced looked random to a person but followed a pattern a computer could recreate. Coinspect calculated that it shrank the pool of possible keys from that 128-bit figure to about 2 to the power of 39 for some wallets and 2 to the power of 47 for others: roughly 550 billion and 140 trillion possibilities. To a human, still enormous. To a bank of fast computers testing billions of guesses a second, a manageable job.

The attack then needs nothing clever. The thief generates every key the flawed code could have made, works out the wallet address each key controls, and checks those addresses against the blockchain, the public ledger that shows every balance. When a guess matches a funded wallet, the money moves. The owner's phone or computer is never touched.

Five wallets, eight years

Coinspect first disclosed the flaw on 6 July 2026 without naming the wallets, so as not to point other thieves at accounts that had not yet been emptied. It said it had found 2,114 vulnerable addresses with activity on five networks: Bitcoin, Ethereum, Tron, Polygon and Rootstock, a network that lets bitcoin be used in the kind of automated contracts Ethereum runs. The earliest of them had first received money in September 2018. Some had been created only weeks before the May sweep.

In early August Coinspect named five apps, all small mobile or browser wallets rather than household names: RRWallet, Bexo, NanChat, Bitcoin Libre and Milo. RRWallet and Milo have shut down, leaving their users with no fix and no one to ask. Bitcoin Libre fixed the problem in version 4, released in July 2024, almost two years before anyone was robbed. NanChat fixed it in version 1.3.0 and told everyone who had created a wallet on an older version to treat it as compromised. Bexo released a fix in version 20.1.0, though at the time of Coinspect's check it had not yet reached the app stores. The flaw now has an official vulnerability number, CVE-2026-71851, and Coinspect warns that the list of five may not be complete, because CryptoJS sits inside so many other programs.

The fix is the cruel part. An update protects only keys made after it. A recovery phrase created by the flawed code stays guessable forever, wherever it is used, even if it is typed into a hardware wallet, a dedicated device built for safe storage. The only remedy is a brand-new phrase and moving the money across, the equivalent of changing every lock rather than repainting the front door.

Who is to blame

Nobody knows who ran the sweeps, and no arrest, charge or recovery has been reported. Coinspect has published the vulnerable addresses and, on 21 August, a free checker called Unlukey that compares a public wallet address against its lists without asking for any secret. A match is a clear warning. A clean result is not a guarantee, because the lists cover only certain types of phrase and network.

The owners of drained wallets have little recourse. Two of the five apps no longer exist. The others are small developers, and none has announced compensation. Coinspect says keys made by hardware wallets and by most mainstream software wallets are not affected.

The pattern is not new. In 2023 the Milk Sad researchers showed that a widely used bitcoin tool, Libbitcoin Explorer, made keys from a weak generator, and thieves had already taken about $900,000. The same year Trust Wallet's browser extension was found to have made guessable keys for a time. A few weeks after Ill Bloom, the hardware wallet maker Coinkite admitted that its Coldcard devices had been making weak keys since 2021, and thieves took about $116 million from them. In every case the failure happened at the moment the wallet was created, the one moment its owner has no way to check.