Coinspect security research

Ill Bloom

Ill Bloom: Wallet Drain Analysis (July 2026)

Summary

Ill Bloom is a wallet-generation vulnerability caused by weak randomness during recovery phrase generation. Funds controlled by an affected recovery phrase are at risk across multiple chains.

This note covers a snapshot of one analyzed address set as of 2026-06-30. The purpose is to document historical exposure, confirmed activity, and the measured drain event observed on 2026-05-27.

As of 2026-06-30, the analyzed address set contains 2,114 addresses across Bitcoin, Ethereum, Tron, Rootstock, and olygon, all of which have on-chain activity. The 2026-05-27 sweep drained 431 accounts for approximately $3,140,968. This is an on-going investigation, new affected accounts are continuously being detected.

Analyzed Address Set

The analyzed address set is Ill Bloom Exposed Address Set 1 of June 2026.

FieldValue
Set nameIll Bloom Exposed Address Set 1 of June 2026
As of2026-06-30
Blockchains coveredBitcoin, Ethereum, Tron, Rootstock, Polygon
Seeds Identified2,114
Seeds drained on 2026-05-27 on the relevant chains431

This dataset represents the subset of affected addresses currently under active monitoring and analysis. It is not exhaustive of all chains or all wallets potentially impacted by the Ill Bloom vulnerability. Additional affected addresses may exist on other networks or may be identified as the investigation continues.

Figures reported below should be understood as a measured lower bound based on confirmed observations within this defined analyzed address set.

Value Drained

The 2026-05-27 drain affected 431 accounts and moved approximately $3,140,968. The drain is split between one identified software wallet Wallet 1 and an all-encompasing Other because the groups differ sharply in scale.

Drained Accounts by Group

GroupAccounts drainedValue drained
Wallet 1260$283,100
Other171$2,857,868
Total431$3,140,968

Drained Value by Chain

ChainValue drained
Bitcoin$2,573,522
Ethereum$285,778
Rootstock$177,225
Tron$80,970
Polygon$23,473
Total$3,140,968

Wallet 1 accounts represent the majority of drained accounts but only a small share of the drained value: 260 of 431 drained accounts, or approximately 60%, and approximately $283,100 of $3,140,968, or 9%.

The value is concentrated in Other accounts. One drained Bitcoin account alone accounts for more than $1.1M.

Stolen amounts

The historical sum of stolen amounts per chain is as follows:

$3.14M stolen out of $12.56M peak-exposure Lower bound · clearly-drain transactions, USD at time of theft · 27 May coordinated window · 431 accounts $0 $1.25M $2.50M $3.75M $5.00M Bitcoin $2.57M Ethereum $286k Rootstock $177k Tron $81k Polygon $23k

Aggregated stolen amount per chain.

First-Funding Timeline

First funding is determined by the first incoming transaction to each address.

Across the reported chains, 2,114 addresses had on-chain activity between 2018-09 and 2026-05. New funded addresses continued to appear through 2025 and 2026, including the month of the 2026-05-27 sweep.

New weak-key wallets are still being funded Watched addresses by month Wallet 1 Other last 12 months 0 10 20 30 40 50 60 2019 2020 2021 2022 2023 2024 2025 2026 watched addresses first seen / month date 27 May sweep

Addresses in the analyzed address set by month of first funding, Wallet 1 vs Other.

Funds at Risk Over Time

Funds at risk is the reconstructed USD value of assets held by the analyzed address set, re-priced month by month. It is a stock measurement, not a flow measurement. It answers how much value was reachable at a given point in time.

USD holdings per month. Wallet 1 and Other are shown separately because their peak balances differ by approximately 40x.

The analyzed address set reached an exposure peak of approximately $12.56M in 2022-04, then declined through the bear market and dropped sharply in 2026-05 during the drain event.

$0 $250k $500k $750k $1.0M 2018 2019 2020 2021 2022 2023 2024 2025 2026 May 2026 Funds at risk — Wallet 1 date $0 $5.0M $10.0M $15.0M $20.0M 2018 2019 2020 2021 2022 2023 2024 2025 2026 May 2026 Funds at risk — Other date

The two groups peaked at different times:

GroupPeak exposurePeak month
Wallet 1$610,0002025-08
Other$12.4M2022
Total set$12.56M2022-04

The decline from 2022 through 2026 mostly reflects falling market prices rather than any slow, ongoing theft. The sharp drop in May 2026 lines up with the drain event itself.

The $12.56M figure represents historical exposure at peak, not money that was actually lost. The confirmed stolen amount remains lower, at a floor of about $3.1M.

Drain Event

We identify drains as accounts that sent a single outbound transfer emptying at least 98% of their balance to a destination outside the analyzed address set. Transfers are priced in USD at the time of movement.

Outflow Pattern

To distinguish routine activity from coordinated sweeping, each outflow is plotted as a bubble:

FieldMeaning
X-axisOutflow date
Y-axisUSD value moved
Bubble sizeTransfer amount
Bubble colorDestination fan-in, measured as the number of accounts sending to the same destination

Routine activity usually appears as isolated transfers to one-off destinations. A coordinated sweep appears differently: many unrelated accounts send funds to a small number of shared destinations during the same time period.

Wallet 1 + Other — Bitcoin 3,057 outflow transactions · each bubble = one outflow color = how many different watched wallets sent to that destination address: ≥20 wallets — one address pooling many victims = collector (theft signal) 8–19 wallets — destination shared by several of our wallets 3–7 wallets — lightly shared destination 1–2 wallets — normal — an address only 1–2 of our wallets use (churn) $1 $10 $100 $1k $10k $100k $1M $10M 2019 2020 2021 2022 2023 2024 2025 2026 outflow value (USD, log) date May 2026 Wallet 1 + Other — Ethereum 4,040 outflow transactions · each bubble = one outflow color = how many different watched wallets sent to that destination address: ≥20 wallets — one address pooling many victims = collector (theft signal) 8–19 wallets — destination shared by several of our wallets 3–7 wallets — lightly shared destination 1–2 wallets — normal — an address only 1–2 of our wallets use (churn) ruled out — identified exchange/DEX/protocol — irrelevant regardless of fan-in $1 $10 $100 $1k $10k $100k $1M $10M 2019 2020 2021 2022 2023 2024 2025 2026 outflow value (USD, log) date May 2026

On 2026-05-27, across the analyzed address set, the drain forms a concentrated outflow column, with many affected accounts converging on a few Ethereum collector addresses within hours.

Conclusion

The Exposed Address Set 1 shows a lower-bound drain of approximately $3.1M across 431 accounts on 2026-05-27. Historical value across the set was higher, peaking at approximately $12.56M in 2022-04, representing the maximum exposure.

The investigation remains ongoing, and additional affected addresses continue to be identified through vulnerable seed search and blockchain analysis. The findings are being shared with key ecosystem participants to support coordinated mitigation efforts.