Chinese-Mnemonic Wallet Drains Analysis
Summary
This note presents a Chinese-mnemonic subset within the Ill Bloom Exposed Address Set 1. The purpose is to document the coordinated drain event observed between 2026-07-20 and 2026-07-21 and its relationship to the previously documented drain activity.
As of 2026-07-22, the Chinese-mnemonic subset contains 142 seeds across Bitcoin, Ethereum, and Tron. A coordinated cross-chain sweep between 2026-07-20 and 2026-07-21 drained 81 seeds for approximately $38,563. The remaining seeds have near-zero residual value at the time of analysis.
Unlike the larger drain events documented previously, this subset represents a relatively small amount of value, but it provides important evidence that attacker activity was not limited to English mnemonic wordlists.
Address Set
The address set is the Chinese-mnemonic subset of Ill Bloom Exposed Address Set 1.
| Field | Value |
|---|---|
| Set name | Ill Bloom Exposed Address Set 1 (Chinese-mnemonic subset) |
| As of | 2026-07-22 |
| Blockchains covered | Bitcoin, Ethereum, Tron |
| Seeds identified | 142 |
| Seeds with observed drains | 81 |
Value Drained
The coordinated sweep between 2026-07-20 and 2026-07-21 affected 81 seeds and moved approximately $38,563.
Drained Seeds by Chain
| Chain | Seeds drained | Value drained |
|---|---|---|
| Bitcoin | 29 | $34,325 |
| Ethereum | 58 | $3,792 |
| Tron | 1 | $446 |
| Total | 81 | $38,563 |
Ethereum accounts for the largest number of affected seeds, while Bitcoin accounts for the majority of the realized losses. The Bitcoin losses were concentrated in a relatively small number of higher-value accounts, including one address that held approximately 0.258 BTC at the time of the sweep.
Drain Event
We identify drains as accounts that sent a transaction removing at least 90% of their balance or spendable UTXOs to a destination outside the address set.
The Ethereum drains converged on two externally owned collector addresses. These collectors had also appeared in previous Ill Bloom drain analyses and were reused across multiple victim seeds, linking this activity to the broader drain campaign.
On Bitcoin, the drained funds were routed through a small number of shared collector addresses, with subsequent forwarding through pass-through accounts before consolidation into downstream destinations.
Conclusion
The realized losses are small compared with the approximately $5.69M documented across the two main Ill Bloom drain events. However, the operational pattern is consistent with the same broader campaign. The reuse of Ethereum collector infrastructure, the coordinated multi-chain execution, and the presence of Chinese mnemonic wordlist-derived wallets indicate that the attacker activity extended beyond the previously analyzed English mnemonic subset.