Ill Bloom — Weak Randomness Wallet Vulnerability

Timeline: Prior to May 27, 2026: root-cause discovery of the weak-PRNG seed generation vulnerability by unidentified attacker(s), later named 'Ill Bloom' by Coinspect (from the first weak seed phrase produced, 'illness blossom'). May 27, 2026: coordinated sweep across the analyzed address set — 431 accounts drained for $3,140,968 in total, funds converging on a small number of Ethereum collector addresses within hours. Between May 27 and July 5, 2026: Coinspect investigates and coordinates a staged responsible disclosure with affected wallet vendors, withholding technical exploit details and vendor names to limit further harm. July 5, 2026 (Sunday): Coinspect publicly discloses the Ill Bloom vulnerability and launches a public address checker at illbloom.org. July 5-6, 2026: approximately $2M additional value moves from exposed wallets — Coinspect does not characterize all of this as theft, noting it could partly reflect users proactively migrating funds after the warning. July 6, 2026: wide media pickup (TechTimes, BeInCrypto, Cointelegraph, crypto.news, Cryptonomist); SlowMist confirms it is monitoring the alert on X. July 10, 2026, 18:51 UTC: Coinspect posts an active-drain alert on X identifying a Bitcoin collector address (bc1phdwxpx7...k9rzlf) receiving funds from lower-balance addresses in the exposed set, while stating that higher-balance victims are being drained to separate, undisclosed destinations. Investigation remains ongoing; additional affected addresses continue to be identified.