2,114 Wallets Were Born Broken. The 'Ill Bloom' Flaw Means Some Seed Phrases Were Never Secrets at All — and the Fix Is a Migration Most People Will Botch.

On July 10, 2026, The Hacker News updated its coverage of a disclosure that every self-custodian should read slowly. Security firm Coinspect has named a crypto wallet flaw "Ill Bloom" — after "illness blossom," the first phrase its weak generator produces — and attackers did not wait for the write-up. On May 27, a single coordinated sweep drained roughly $3.1 million from 431 wallets, with Bitcoin taking the worst of it at about $2.57 million and one address losing more than $1.1 million on its own. As of June 30, Coinspect had traced 2,114 exposed addresses with on-chain activity across Bitcoin, Ethereum, Rootstock, Tron, and Polygon, and counting movements since the sweep, more than $5 million has left the vulnerable set. Coinspect calls that a floor, not a ceiling. The firm has published a free checker at illbloom.org where you can paste a public address and see whether it appears on the watchlist. Its accompanying warning is the whole story in one sentence: "if funds recently moved without your permission, this vulnerability may be why."

What broke is worth understanding precisely, because nothing about it resembles the thefts this publication usually covers. A BIP-39 seed phrase is supposed to be drawn at random from a pool so vast that guessing is hopeless — that vastness is the entire security model. The affected wallets, some created as far back as 2018 and concentrated among older or lesser-known mobile apps, used a weak pseudorandom number generator when creating the phrase. Weak randomness collapses the pool: instead of a space no computer could ever search, the generator could only ever produce phrases from a range small enough for an attacker to enumerate. Coinspect rebuilt the attack end to end — worked through the full set of phrases the weak generator could emit, derived the addresses each one leads to, and checked the public blockchain for which still held funds. The thieves evidently did the same, and Coinspect could tell the May 27 theft was one operation because hundreds of unrelated wallets sent their balances to the same few collection addresses within hours. This is not a new failure, just a new name: the Milk Sad flaw in Libbitcoin Explorer drained millions in one sweep in July 2023, a cousin hit the Trust Wallet browser extension the same year, and Randstorm left browser-generated wallets from 2011 to 2015 crackable for the same reason. Every few years, a generator turns out to be predictable, and wallets that looked safe become drainable.

Here is what should unsettle you, and this publication is not going to soften it: the victims did everything right downstream, and none of it mattered. No seed phrase was phished, photographed, or coerced out of anyone. No drawer was opened, no camera was hidden, no letter arrived in the mail. The words could have been engraved on titanium, locked in a bank vault, or — and this is the uncomfortable part for a site about threshold custody — split with Shamir's Secret Sharing into five shares on five continents, and the coins would be exactly as gone. Splitting a secret protects the copies of the secret. It does nothing for a secret that was never really a secret — a phrase that an attacker can regenerate from scratch because the machine that picked it was predictable. A guessable seed split into shares is distributed garbage. Ill Bloom is the one attack in the self-custody threat model that no backup architecture, ours included, can defend against, and any vendor who implies otherwise is selling you something.

The honest way to hold this is to see self-custody as a lifecycle with distinct layers, each with its own failure mode and its own defense. Generation is the moment the secret is born, and its security lives entirely in the randomness of the machine that births it. Storage and backup is the long quiet decades after, and its security lives in where the complete secret exists and who can reach it. Use is the brief window when the secret must be whole — the moment a hidden camera or a phishing page exploits. A weak generator is a layer-one failure, and layer-one failures cannot be repaired downstream: not by better storage, not by splitting, not by vigilance. The only fix is to leave — generate a fresh seed on trustworthy hardware and move the funds. That is why the practical guidance is short. Coinspect says wallets created on hardware devices are not affected, and most mainstream software wallets are fine; the risk sits with older and lesser-known mobile apps. Check every address tied to a suspect seed at illbloom.org, remember that a clean result is not a guarantee because the list is incomplete, and if you match, treat the phrase as compromised even if the money has not moved yet.

But look closely at what the fix demands, because this is where the story bends back toward territory this publication knows well. The remedy for Ill Bloom is a migration: create a brand-new wallet with a brand-new phrase, and move everything. Right now, thousands of frightened people are doing exactly that — generating fresh seed phrases in a hurry, writing twelve new words on whatever paper is closest, photographing them "just for now," typing them into apps to double-check, and deciding they will sort out a proper backup later. A rushed migration is the single most exposure-dense event in the life of a wallet: the new secret exists complete, in the open, handled by a stressed person, often on the same possibly-compromised phone that held the old one. And the predators know it. Coinspect's disclosure carries its own warning about "rescue" scammers who circle events like this, offering to protect or recover funds — the firm states plainly that it will never ask for seed phrases, private keys, signatures, or approvals. A real checker needs only a public address. Anyone who asks for more is running the second wave of the same theft.

This is where threshold custody actually earns its place in the Ill Bloom story — not as a defense against the flaw, which it is not, but as the answer to the question every matched user now faces: when I generate the new seed, where does it land? The default answer is the same place the old one lived — one complete copy, one drawer, one photograph — which merely trades a layer-one failure for a layer-two one and waits for a different post on this blog to describe the consequences. The better answer is to make the migration the moment your architecture improves: generate the new seed on a hardware device whose randomness is not in question, then encrypt it and split it into a threshold set of shares — say 3-of-5 — so that the complete phrase stops existing anywhere the moment the backup is made. Below the threshold, Shamir's scheme reveals information-theoretically nothing, so no single share lost, photographed, or scanned in the chaos of a migration exposes anything at all. You cannot fix a seed born weak. You can make certain the seed that replaces it is never again one event away from gone.

seQRets sits exactly there, and it is honest about the boundary. It cannot strengthen a weak seed — splitting a phrase an attacker can regenerate protects nothing, and generation is your wallet's job, not ours. What seQRets does is take a seed that was generated well and remove the single complete copy: encrypted, split into QR-encoded threshold shares, distributed across the locations and people you choose, no servers, no accounts, nothing for the next sweep to find. Ill Bloom is a reminder that some failures happen before you ever touch the secret. Everything after that moment, though, is architecture — and the architecture is the part you control.