Table of Contents
Key Takeaway
- 💰 $5.7 million stolen via guessable recovery phrases: Blockchain security firm Coinspect confirmed that a weak random number generator in CryptoJS, introduced 12 years ago, made wallet recovery phrases predictable across five crypto wallet apps. Attackers stole at least $5,690,922 across two sweeps in May-July 2026.
- 🔑 128-bit entropy reduced to 2^39: The vulnerable function should have produced search spaces of 2^128 or 2^256, but the weak generator collapsed them to roughly 2^39 and 2^47 — small enough to enumerate on ordinary consumer hardware.
- 📱 Five affected wallet apps: RRWallet (discontinued), Bexo Wallet (fixed in v20.1.0), NanChat (fixed in v1.3.0), Bitcoin Libre (fixed in v4), and Milo (discontinued). If you used any of these, your recovery phrase may be compromised.
- ⚠️ Updating the app does NOT fix an existing phrase: A recovery phrase generated by a vulnerable version remains guessable forever — even if imported into a hardware wallet. Users must generate a new phrase securely and move all funds immediately.
- 🛡️ Action plan: Check if your wallet is affected, generate a new recovery phrase using a hardware wallet or current software wallet with proper CSPRNG, and transfer all funds to the new wallet.
Blockchain security firm Coinspect has confirmed that a 12-year-old weakness in a widely used JavaScript cryptography library made crypto wallet recovery phrases predictable across at least five wallet apps, enabling attackers to steal a minimum of $5,690,922 from thousands of users. The crypto wallet vulnerability, dubbed “Ill Bloom,” traces back to CryptoJS.lib.WordArray.random(), a function that supplied weak entropy for generating the 12- or 24-word recovery phrases that protect self-custody crypto wallets. For Filipino crypto investors and OFW remittance users who hold digital assets, this crypto wallet vulnerability is not a theoretical risk — it is an active, ongoing threat that requires immediate action.
What Is the Ill Bloom Crypto Wallet Vulnerability?
The Ill Bloom vulnerability targets the moment of wallet creation. When you create a new crypto wallet, the app generates a recovery phrase — a sequence of 12 or 24 words derived from a random number. These words serve as the master key to your wallet: anyone who has them can access and transfer all your funds. The security of the entire system depends on the randomness being truly unpredictable.
The problem: CryptoJS.lib.WordArray.random(), a function introduced in the CryptoJS library in June 2014, used a weak random number generator called Multiply-With-Carry, seeded from JavaScript’s Math.random(). This generator did not produce cryptographically secure randomness. Instead of generating entropy in the 2^128 or 2^256 range (which would take trillions of years to brute-force), the weak generator collapsed the search space to roughly 2^39 and 2^47 — small enough that an attacker with an ordinary computer could enumerate all possible recovery phrases in hours or days.
Coinspect reproduced the attack chain by enumerating the weak generator’s outputs, converting them into BIP-39 recovery phrases, deriving wallet addresses from those phrases, and checking the addresses against public blockchain data. When they found addresses with balances, they had the corresponding recovery phrases — and so did the attackers. The full technical analysis is available on The Hacker News and the Ill Bloom disclosure site.
The Five Affected Wallet Apps
Coinspect confirmed five applications that used the vulnerable CryptoJS function as an entropy source for recovery phrase generation:
| Wallet App | Status | Fix Version | Action Needed |
|---|---|---|---|
| RRWallet | Discontinued | No fix available | Move all funds to a new wallet immediately |
| Bexo Wallet | Active | v20.1.0 (not yet on app stores as of Aug 6) | Move all funds to a new wallet immediately |
| NanChat | Active | v1.3.0 (fixed June 12, 2026) | If wallet created before v1.3.0, move funds immediately |
| Bitcoin Libre | Active | v4 (July 2024) | If wallet created before v4, move funds immediately |
| Milo | Discontinued | No fix available | Move all funds to a new wallet immediately |
Coinspect cautioned that it cannot confirm these are the only vulnerable wallets. Other affected mobile or browser-extension wallets may have existed but could not be examined because they had already been removed from app stores or replaced with patched versions.
How the Attackers Stole $5.7 Million
Coinspect’s on-chain analysis tracked two drain waves attributed to the Ill Bloom crypto wallet vulnerability:
| Drain Wave | Date | Amount Stolen | Accounts Affected |
|---|---|---|---|
| First sweep | May 27, 2026 | $3.14 million | 431 accounts |
| Second sweep | May 30 – July 13, 2026 | $2.55 million | 522 seeds (including $2.18M USDT from one Tron account on July 4) |
| Total | $5,690,922 | 2,114 identified seeds across Bitcoin, Ethereum, Tron, Rootstock, Polygon |
Coinspect described this as a “lower bound” — the actual losses are likely higher. The firm estimated from blockchain data that the affected population runs into the thousands across Ethereum Virtual Machine (EVM)-compatible networks and Bitcoin.
Why Updating Your App Does Not Fix This Crypto Wallet Vulnerability
This is the most critical point: a recovery phrase generated by a vulnerable version of any affected wallet remains guessable forever. Updating the wallet app to a patched version does not repair the existing phrase. Importing the same recovery phrase into a different, fully up-to-date wallet — including a hardware wallet like Ledger or Trezor — transfers the compromised keys into the new environment. The weakness is permanently encoded in the phrase itself.
Once a recovery phrase has been generated from the vulnerable function’s output, subsequent hashing or PBKDF2 processing cannot restore the missing entropy. The only solution is to generate a completely new recovery phrase using a properly seeded cryptographically secure pseudorandom number generator (CSPRNG), and then transfer all funds from the old wallet to the new one.
CryptoJS maintainer Evan Vosberg published security advisory GHSA-rg76-677x-56q9 on August 5, 2026, with a Critical rating and CVSS score of 9.0. The advisory covers every CryptoJS release below 4.0.0, with the exception of 3.2.0 and 3.2.1 which temporarily switched to native cryptographic randomness before 3.3.0 restored the weak code.
How to Check If You Are Affected
If you hold cryptocurrency and used any of the five affected wallet apps — RRWallet, Bexo Wallet, NanChat (before v1.3.0), Bitcoin Libre (before v4), or Milo — your recovery phrase may be compromised. Here is what you should do:
Step 1: Identify Your Wallet App and Version
Check which wallet app you used to create your current recovery phrase. If it is one of the five affected apps, proceed to Step 2 immediately. If you used a hardware wallet (Ledger, Trezor, SafePal) or a major software wallet (Trust Wallet, MetaMask, Exodus, Electrum) that uses native cryptographic randomness, you are likely unaffected — but verify with the wallet’s official documentation.
Step 2: Generate a New Wallet with a Secure Recovery Phrase
Use a hardware wallet or a current, updated software wallet that uses a properly seeded CSPRNG. Write down the new recovery phrase on paper — never store it digitally. Keep it in a secure, offline location.
Step 3: Transfer All Funds to the New Wallet
Send all your cryptocurrency from the old (potentially compromised) wallet to the new wallet address. Do this in small test transactions first to confirm the address is correct. Once all funds are transferred, consider the old wallet permanently compromised and never use it again.
Step 4: Destroy the Old Recovery Phrase
Once all funds are safely in the new wallet and you have confirmed receipt, destroy the old recovery phrase. Do not keep it as a “backup” — it is a liability, not a safety net.
What This Means for Filipino Crypto Investors
The Philippines has one of the highest crypto adoption rates in Southeast Asia. Millions of Filipinos use cryptocurrency for remittances, investment, and online payments. The Bangko Sentral ng Pilipinas (BSP) has registered multiple Virtual Asset Service Providers (VASPs), and platforms like Coins.ph, PDAX, and GCrypto serve millions of Filipino users.
For Filipino investors who hold self-custody wallets — where they control their own recovery phrases rather than trusting an exchange — the Ill Bloom crypto wallet vulnerability is a direct threat. If you used any of the five affected apps to generate your wallet, your funds are at risk right now, even if you have not seen any suspicious activity. The attackers have the technology to regenerate your recovery phrase and drain your wallet at any time. This is different from phishing attacks Philippines where you have to click a link — here, the attacker does not need you to do anything. They compute your key offline and strike.
This crypto wallet vulnerability also highlights a broader lesson for Filipino crypto users: not all wallet apps are created equal. The BIP-39 standard, which underlies the recovery phrase system used by most self-custody wallets, does not mandate that the entropy used to generate phrases comes from a cryptographically secure source. This means wallet developers are responsible for using proper randomness — and when they fail, users bear the cost.
The Bigger Picture: Self-Custody Risk in 2026
The Ill Bloom disclosure is the latest in a series of self-custody wallet vulnerabilities. The Milk Sad vulnerability in 2023 and the Trust Wallet browser extension incident in 2024 both involved weak entropy in recovery phrase generation. Each incident exposed a structural gap: the BIP-39 mnemonic standard does not enforce cryptographically secure entropy, leaving the door open for developers who use weak random number generators. For broader cybersecurity guidance, see our cybersecurity Philippines 2026 complete guide and our coverage of AI toolchain attack trends.
Coinspect withheld the technical details of the Ill Bloom crypto wallet vulnerability for two months while notifying vendors and searching for exposed addresses. This responsible disclosure period gave wallet developers time to patch their apps — but it also means attackers may have been exploiting the vulnerability for months before the public disclosure.
Frequently Asked Questions About Crypto Wallet Vulnerability 2026
What is the Ill Bloom crypto wallet vulnerability?
Ill Bloom is a crypto wallet vulnerability in CryptoJS.lib.WordArray.random(), a JavaScript function that used a weak random number generator to create wallet recovery phrases. The weakness made recovery phrases predictable, allowing attackers to regenerate them and steal funds. Coinspect confirmed $5.7 million stolen across five affected wallet apps.
Which wallet apps are affected by the Ill Bloom vulnerability?
Five confirmed apps: RRWallet (discontinued), Bexo Wallet (fixed in v20.1.0), NanChat (fixed in v1.3.0), Bitcoin Libre (fixed in v4), and Milo (discontinued). If you created a wallet with any of these apps, your recovery phrase may be guessable by attackers.
Does updating my wallet app fix the vulnerability?
No. A recovery phrase generated by a vulnerable version remains guessable forever — even if you update the app or import the phrase into a hardware wallet. The only fix is to generate a new recovery phrase with a secure wallet and transfer all funds to the new wallet.
How much was stolen in the Ill Bloom attacks?
Coinspect confirmed $5,690,922 stolen across two drain waves: $3.14 million from 431 accounts on May 27, 2026, and $2.55 million from 522 seeds between May 30 and July 13, 2026. This is a confirmed lower bound; actual losses are likely higher.
Are hardware wallets affected by this crypto wallet vulnerability?
Hardware wallets that generate their own recovery phrases using native cryptographic randomness (such as Ledger, Trezor, and SafePal) are not affected. However, if you imported a recovery phrase from an affected app into a hardware wallet, that phrase is still compromised and funds must be moved to a new wallet.
How can I protect my crypto wallet from this vulnerability?
If you used any of the five affected apps, generate a new recovery phrase using a hardware wallet or a current software wallet with proper CSPRNG, transfer all funds to the new wallet, and destroy the old recovery phrase. Never reuse a recovery phrase from a potentially compromised wallet.
Financial Disclaimer
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency investments carry a high level of risk, and you should consult a licensed financial advisor before making any investment decisions. The authors and publishers of this article are not responsible for any financial losses resulting from the use of this information.
