Coinspect warns Ill Bloom puts wallets at risk

• Coinspect said the "Ill Bloom" vulnerability could expose thousands of cryptocurrency wallets created with weak recovery phrase generation.
• The security firm estimates at least US$5 million has been stolen from affected wallets since 27 May across multiple blockchains.
• Coinspect urged users to check whether their wallets are affected, while noting hardware wallets and most current software wallets appear unaffected.

Coinspect warned that the "Ill Bloom" vulnerability could expose thousands of cryptocurrency wallets across Bitcoin (CRYPTO:BTC), Ethereum (CRYPTO:ETH), Polygon (CRYPTO:POL), Rootstock, Tron (CRYPTO:TRX) and Solana (CRYPTO:SOL) because of weak recovery phrase generation in certain software wallets.

The security firm said the issue stems from weak randomness used to generate recovery phrases, primarily affecting lesser-known mobile software wallets created as early as 2018, while hardware wallets and most current software wallets do not appear to be vulnerable.

“If funds recently moved without your permission, this vulnerability may be why,” Coinspect said.

Coinspect estimated that at least US$5 million has been stolen from exposed wallets since 27 May, including US$3.1 million drained from 431 of 2,114 vulnerable wallets in one attack and another US$2 million moved from affected wallets on Sunday, while the firm has withheld technical details and instead released a wallet-checking tool.

The company said further losses may occur if affected users do not move their assets, while blockchain security firm SlowMist said it is monitoring the vulnerability and its potential impact.

The disclosure follows previous wallet security incidents, including a 2023 flaw in the Trust Wallet browser extension that reduced the number of possible recovery phrase combinations but was patched before any funds were reported stolen.

Another vulnerability discovered in 2023 affected Libbitcoin Explorer, allowing attackers to brute-force private keys and steal about US$900,000 in cryptocurrency, highlighting the ongoing risks associated with weak entropy generation in wallet software.

At the time of reporting, Bitcoin price was $63,081.23.