Ill Bloom: Wallet Drain Analysis (July 2026)
Summary
Ill Bloom is a wallet-generation vulnerability caused by weak randomness during recovery phrase generation. Funds controlled by an affected recovery phrase are at risk across multiple chains.
This note covers a snapshot of one analyzed address set as of 2026-06-30. The purpose is to document historical exposure, confirmed activity, and the measured drain event observed on 2026-05-27.
As of 2026-06-30, the analyzed address set contains 2,114 addresses across Bitcoin, Ethereum, Tron, Rootstock, and olygon, all of which have on-chain activity. The 2026-05-27 sweep drained 431 accounts for approximately $3,140,968. This is an on-going investigation, new affected accounts are continuously being detected.
Analyzed Address Set
The analyzed address set is Ill Bloom Exposed Address Set 1 of June 2026.
| Field | Value |
|---|---|
| Set name | Ill Bloom Exposed Address Set 1 of June 2026 |
| As of | 2026-06-30 |
| Blockchains covered | Bitcoin, Ethereum, Tron, Rootstock, Polygon |
| Seeds Identified | 2,114 |
| Seeds drained on 2026-05-27 on the relevant chains | 431 |
This dataset represents the subset of affected addresses currently under active monitoring and analysis. It is not exhaustive of all chains or all wallets potentially impacted by the Ill Bloom vulnerability. Additional affected addresses may exist on other networks or may be identified as the investigation continues.
Figures reported below should be understood as a measured lower bound based on confirmed observations within this defined analyzed address set.
Value Drained
The 2026-05-27 drain affected 431 accounts and moved approximately $3,140,968. The drain is split between one identified software wallet Wallet 1 and an all-encompasing Other because the groups differ sharply in scale.
Drained Accounts by Group
| Group | Accounts drained | Value drained |
|---|---|---|
| Wallet 1 | 260 | $283,100 |
| Other | 171 | $2,857,868 |
| Total | 431 | $3,140,968 |
Drained Value by Chain
| Chain | Value drained |
|---|---|
| Bitcoin | $2,573,522 |
| Ethereum | $285,778 |
| Rootstock | $177,225 |
| Tron | $80,970 |
| Polygon | $23,473 |
| Total | $3,140,968 |
Wallet 1 accounts represent the majority of drained accounts but only a small share of the drained value: 260 of 431 drained accounts, or approximately 60%, and approximately $283,100 of $3,140,968, or 9%.
The value is concentrated in Other accounts. One drained Bitcoin account alone accounts for more than $1.1M.
Stolen amounts
The historical sum of stolen amounts per chain is as follows:
Aggregated stolen amount per chain.
First-Funding Timeline
First funding is determined by the first incoming transaction to each address.
Across the reported chains, 2,114 addresses had on-chain activity between 2018-09 and 2026-05. New funded addresses continued to appear through 2025 and 2026, including the month of the 2026-05-27 sweep.
Addresses in the analyzed address set by month of first funding, Wallet 1 vs Other.
Funds at Risk Over Time
Funds at risk is the reconstructed USD value of assets held by the analyzed address set, re-priced month by month. It is a stock measurement, not a flow measurement. It answers how much value was reachable at a given point in time.
USD holdings per month. Wallet 1 and Other are shown separately because their peak balances differ by approximately 40x.
The analyzed address set reached an exposure peak of approximately $12.56M in 2022-04, then declined through the bear market and dropped sharply in 2026-05 during the drain event.
The two groups peaked at different times:
| Group | Peak exposure | Peak month |
|---|---|---|
| Wallet 1 | $610,000 | 2025-08 |
| Other | $12.4M | 2022 |
| Total set | $12.56M | 2022-04 |
The decline from 2022 through 2026 mostly reflects falling market prices rather than any slow, ongoing theft. The sharp drop in May 2026 lines up with the drain event itself.
The $12.56M figure represents historical exposure at peak, not money that was actually lost. The confirmed stolen amount remains lower, at a floor of about $3.1M.
Drain Event
We identify drains as accounts that sent a single outbound transfer emptying at least 98% of their balance to a destination outside the analyzed address set. Transfers are priced in USD at the time of movement.
Outflow Pattern
To distinguish routine activity from coordinated sweeping, each outflow is plotted as a bubble:
| Field | Meaning |
|---|---|
| X-axis | Outflow date |
| Y-axis | USD value moved |
| Bubble size | Transfer amount |
| Bubble color | Destination fan-in, measured as the number of accounts sending to the same destination |
Routine activity usually appears as isolated transfers to one-off destinations. A coordinated sweep appears differently: many unrelated accounts send funds to a small number of shared destinations during the same time period.
On 2026-05-27, across the analyzed address set, the drain forms a concentrated outflow column, with many affected accounts converging on a few Ethereum collector addresses within hours.
Conclusion
The Exposed Address Set 1 shows a lower-bound drain of approximately $3.1M across 431 accounts on 2026-05-27. Historical value across the set was higher, peaking at approximately $12.56M in 2022-04, representing the maximum exposure.
The investigation remains ongoing, and additional affected addresses continue to be identified through vulnerable seed search and blockchain analysis. The findings are being shared with key ecosystem participants to support coordinated mitigation efforts.