Coinspect security research
Ill Bloom: Crypto Wallet Vulnerability
Ill Bloom is the name of a wallet-generation vulnerability now tracked as CVE-2026-71851. Our investigation identified wallet addresses derived from recovery phrases generated through a weak randomness implementation in CryptoJS.
We have identified several software wallet applications that used the vulnerable CryptoJS implementation during recovery phrase generation, but additional affected applications may exist (see FAQ).
Use this checker to see whether a public wallet address appears in our dataset of known exposed wallet addresses. If your address matches, let us know which wallet generated the recovery phrase to help us identify additional affected wallet software.
Only enter wallet addresses. NEVER enter your recovery phrase, seed phrase, mnemonic, private key, password, or wallet backup file.
Updated August 21, 2026: As part of our ongoing research into weak seed generation, we have launched Unlukey, a public address checker that brings together datasets from multiple wallet-generation vulnerabilities. The Ill Bloom dataset is available through both checkers.
Is my wallet exposed?
The checker only needs a public wallet address. Do not enter any secret. Your address is not sent anywhere.
Enter an address.Research
- Wallet Drain of May 2026 Analysis On-chain forensics of the May 2026 coordinated drain across Bitcoin, Ethereum, Polygon, Rootstock and Tron wallets derived from weak recovery phrases.
- Second Wave of Wallet Drains Analysis On-chain forensics of a second coordinated drain (May–July 2026) across Bitcoin, Ethereum, Polygon, Rootstock and Tron wallets derived from weak recovery phrases.
- Chinese-Mnemonic Wallet Drains Analysis A coordinated cross-chain sweep between 2026-07-20 and 2026-07-21 drained funds associated with seeds from the Chinese mnemonic subset.
- Technical Disclosure: The CryptoJS Randomness Vulnerability How a weak CryptoJS pseudorandom number generator reduced BIP39 recovery phrase entropy and reached wallet software.
- Identifying the Wallets Behind Vulnerable Recovery Phrases How we identified wallet applications associated with the weak entropy-generation mechanism behind the Ill Bloom vulnerability.
- Dataset Construction Methodology Methodology used to identify affected recovery phrases and construct the Ill Bloom Exposed Address Set 1 of June 2026.
FAQ
Who is affected?
The affected users are those who generated their recovery phrase with one of the vulnerable software wallet applications identified so far. We have confirmed five: RRWallet, Bexo, NanChat, Bitcoin Libre, and Milo. Other vulnerable wallets may exist.
When did this get exploited on-chain?
The first confirmed on-chain evidence we identified dates back to May 27, 2026. Additional drain events have been observed since then and are documented in our on-chain analysis articles.
What is the root cause of this issue?
The root cause was a weak randomness implementation in CryptoJS, now tracked as CVE-2026-71851.
What should I do if my address matches?
If your address matches, funds controlled by the same recovery phrase are at risk. The safest remediation is to create a new wallet with a new recovery phrase and migrate your funds to addresses from that new wallet. Updating an app or importing the same recovery phrase into another app does not make your funds safe.
How do I know I created a new wallet?
You should be shown a new set of 12 to 24 words. If you are asked to enter your existing recovery phrase, seed phrase, or backup phrase, you are restoring the old wallet, not creating a new one.
Does a negative result mean my wallet is safe?
No. A negative result only means the address was not found in the Ill Bloom address sets. The address sets are not exhaustive: they cover a specific set of recovery phrase types, networks and derivation paths, described in our dataset methodology.
Which chains are affected?
A vulnerable recovery phrase can put funds at risk across multiple chains. The risk is not limited to the chain where suspicious activity was first seen. Affected users hold portfolios spread across Bitcoin, Ethereum, Tron, Solana, BNB Chain, Polygon, Monad, Arbitrum, Gnosis, Optimism, Base, Avax, Linea, and HyperEVM.
Why can't you name every affected wallet app?
We have confirmed and published the wallet applications we could identify, but that list is not exhaustive. A public wallet address does not reveal which app generated its recovery phrase.
How can I choose a wallet to migrate my funds to?
Consider using a hardware wallet or visit our Wallet Security Ranking to compare software wallet apps.
Why is it called Ill Bloom?
Ill Bloom comes from a wordplay on the first recovery phrase produced by the vulnerable PRNG, which begins with "illness blossom."
Have similar incidents occurred in the past?
Yes. Previous cases, including Milk Sad and a Trust Wallet browser extension issue, involved vulnerable wallets caused by weak randomness.
How can I get updates?
Follow @coinspect, where we will be posting updates.
Who are you?
Coinspect is a security research and auditing firm that has been working in the blockchain space for more than 12 years.