The Coinspect team reported an Ill Bloom vulnerability related to weak entropy in the generation of SI phrase, which allows intruders to wield private keys and gain access to funds. The problem has already led to at least $3 million in losses for Bitcoin, Ethereum, Polygon, Rootstock, Tron, and Solana networks. Researchers analyzed 2,114 addresses, emphasizing that these are only a subset of the potentially affected wallets.

The main risk group is little-known mobile applications, while hardware and popular software solutions are not affected. The vulnerable generation mechanism has been in place since at least 2018, and users continued to create potentially vulnerable wallets until recent weeks. Due to the ongoing threat, Coinspect did not disclose technical details but released a tool for address verification and passed information to developers.

On May 27, the experts recorded a coordinated withdrawal of funds from 431 vulnerable wallets worth ~$3.14 million, of which $2.57 million was for Bitcoin. A few hours after the alert was published on July 4, the associated addresses withdrew another $2 million - perhaps the owners moved funds themselves. The investigation continues with the involvement of SlowMist.