Ill Bloom: Second Wave of Wallet Drains Analysis
Summary
This note presents a snapshot of a monitored address set as of 2026-06-30. The purpose is to document historical exposure, confirmed activity, and the measured losses from a second drain event that occurred between 2026-05-30 and 2026-07-13, following the first documented drain event observed on 2026-05-27.
As of 2026-07-13, the monitored address set contains 2,114 seeds across Bitcoin, Ethereum, Tron, Rootstock, and Polygon, all of which have on-chain activity. This second sweep event drained 522 seeds for approximately $2,550,000.
The total amount of stolen funds ascends to approximately $5,691,000 across both drain events.
Monitored Address Set
The monitored address set is Ill Bloom Exposed Address Set 1 of May 2026.
The accounts drained in this second event belong to the same set published in our first analysis. Additional affected addresses may exist on other networks or may be identified as the investigation continues.
Figures reported below should be understood as a measured lower bound based on confirmed observations within this defined monitored address set.
Value Drained
This new drain event between 2026-05-30 and 2026-07-13 affected 522 seeds and moved approximately $2,550,000. The results are presented separately for Wallet 1 and Other, as the two groups differ significantly in scale.
Drained Seeds by Group
| Group | Seeds drained | Value drained |
|---|---|---|
| Wallet 1 | 335 | $21,561 |
| Other | 187 | $2,528,393 |
| Total | 522 | $2,549,954 |
Drained Value by Chain
| Chain | Value drained |
|---|---|
| Tron | $2,186,066 |
| Bitcoin | $331,420 |
| Ethereum | $26,301 |
| Polygon | $3,228 |
| Rootstock | $2,939 |
| Total | $2,549,954 |
Value drained per chain in the second event.
Unlike the first event, the value in this event is dominated by a single Tron account drained of approximately 2.18M USDT on 2026-07-04, representing roughly 86% of the total measured losses. Wallet 1 seeds represent the majority of drained seeds but only a small share of the value: 335 of 522 seeds (~64%), yet only about $21,561 of $2,549,954 (~0.8%).
Historical Exposure
Historical exposure is measured in two ways: when the affected addresses first received funds, and how much value was reachable over time.
Funds at Risk Over Time
Funds at risk is the reconstructed USD value of assets held by the monitored address set, re-priced month by month. It is a stock measurement, not a flow measurement. It answers how much value was reachable at a given point in time.
USD holdings per month. Wallet 1 and Other are shown separately because their peak balances differ by approximately 40x.
The monitored address set reached an exposure peak of approximately $12.56M in 2022-04, then declined through the bear market and dropped sharply in 2026-05 during the drain event.
As of 2026-07-13, the total funds at risk over the watched set are effectively zero, as attackers drained the remaining balances during the second window (2026-05-30 to 2026-07-13).
The two groups peaked at different times:
| Group | Peak exposure | Peak month |
|---|---|---|
| Wallet 1 | $610,000 | 2025-08 |
| Other | $12.4M | 2022 |
| Total set | $12.56M | 2022-04 |
The $12.56M figure represents historical exposure at peak, not money that was actually lost.
Drain Event
We identify drains as accounts that sent a single outbound transfer emptying at least 90% of their balance to a destination outside the monitored address set. Transfers are priced in USD at the time of movement.
Outflow Pattern
To distinguish routine activity from coordinated sweeping, each outflow is plotted as a bubble:
| Field | Meaning |
|---|---|
| X-axis | Outflow date |
| Y-axis | USD value moved |
| Bubble size | Transfer amount |
| Bubble color | Destination fan-in, measured as the number of monitored accounts sending to the same destination |
Routine activity typically consists of isolated transfers to unique destination addresses. In contrast, coordinated sweep activity is characterized by many monitored accounts being drained within a short time window, often converging on a small number of shared destination addresses. Large individual drains, however, may be sent directly to a unique destination address.
Two coordinated columns are visible on the shared timeline: the 2026-05-27 event documented in our first analysis and the second event covered in this report.
In the second event, activity spans 2026-05-30 to 2026-07-13, with the heaviest clustering on 2026-07-10 (Bitcoin). Most Bitcoin and EVM drains converged on a small number of reused collector addresses. Unlike the first event, where each victim’s funds went to a separate destination, most of this event’s drains were dust consolidation into a few reused collectors (four on Bitcoin, five across the EVM chains), which is why the second-event bubbles pile into a red (high fan-in) vertical band. A drain is identified not by large transfers or timing alone, but by many monitored accounts emptying to the same destinations within a short time period.
Conclusion
The Exposed Address Set 1 shows a lower-bound drain of approximately $2,549,954 across 522 seeds in this second event, between 2026-05-30 and 2026-07-13. Historical value across the set was higher, peaking at approximately $12.56M in 2022-04, representing the maximum exposure. The total amount of stolen funds ascends to $5,690,922 across both drain events.
The investigation remains ongoing, and additional affected addresses continue to be identified through vulnerable seed search and blockchain analysis. The findings are being shared with key ecosystem participants to support coordinated mitigation efforts.