Hack of 2,100 Wallets Due to an Old Bug; "Ill Bloom" Vulnerability Wipes Out Millions in Cryptocurrency!

An old vulnerability in the CryptoJS programming library has allowed hackers to guess the recovery phrases of some cryptocurrency wallets using ordinary computers, draining users' assets. This vulnerability, dubbed "Ill Bloom," has affected over 2,100 addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon networks, with damages exceeding $5.7 million.

The main danger of this attack is that the issue is not limited to a single wallet or a specific network. CryptoJS has been used for years as a hidden component in hundreds of other software and libraries, and some wallet developers have utilized its random number generation capability to create recovery phrases; a feature that lacked necessary security in vulnerable versions.

How Did the CryptoJS Bug Compromise Wallet Recovery Phrases?

A typical 12-word recovery phrase is cryptographically secure enough that breaking it through standard trial and error methods is practically impossible. However, in some versions of the 3.x CryptoJS library, including version 3.1.2 and versions after it except for 3.2.0 and 3.2.1, the random number generation function was flawed.

In simple terms, this function produced predictable patterns instead of completely random numbers. As a result, the number of possible combinations for wallet recovery phrases was drastically reduced, allowing attackers to check potential options one by one using the processing power of ordinary computers.

The problem became more serious when CryptoJS was not directly visible in many software applications and was used as a software dependency in the background. Consequently, wallet developers might have been unaware of this flaw in their underlying infrastructure.

The First Wave of Theft; $3.14 Million in One Day

The first widespread wave of thefts occurred on May 27, 2026. Attackers targeted 431 accounts in just one day, extracting approximately $3.14 million in cryptocurrency.

Bitcoin accounted for the largest share of this loss, with about $2.57 million of the stolen assets related to this network. Ethereum followed with around $286,000, Rootstock with $177,000, Tron with $81,000, and Polygon with $23,000.

As investigations continued, the number of potentially affected wallets and software also increased.

Why Updating Wallets Is Not Enough to Save Assets?

One of the most important points about the Ill Bloom vulnerability is that updating software does not necessarily save users' assets.

If a wallet's recovery phrase was generated when the software was using a vulnerable version of CryptoJS, that recovery phrase has been weak from the start. Therefore, even if the developer later fixes the bug, the previous recovery phrase will still be predictable.

By August, the names of several wallets, including RWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo Wallet, were mentioned among the affected software. Some of these projects, including Milo and RWallet, have even ceased operations.

However, the developers of Bitcoin Libre have fixed the flaw in older versions, and NanChat has released a new security patch. The new update for Bexo Wallet is still awaiting approval from app stores.

What Should Users of Old Wallets Do?

Experts recommend that users who suspect their wallet's recovery phrase was generated with the vulnerable version of CryptoJS should not just settle for installing the latest software version. They should first check the public addresses associated with the wallet, and if any signs of danger are observed, assets should be transferred to a completely new wallet.

The important point is that users should not wait for a theft to occur to transfer their assets. If the previous recovery phrase can be guessed due to weaknesses in the random number generation process, an attacker can access the corresponding private key at any time.

For this reason, experts advise against keeping significant amounts in wallets whose recovery phrases were generated in a browser or using unreliable software infrastructure.

An Old Flaw, A Threat to Today's Wallet Security

The Ill Bloom saga once again shows that the security of a wallet is not solely dependent on its proprietary codes. Using a third-party library that seemingly has no direct relation to asset management can jeopardize the security of millions of users' private keys.

On the other hand, this attack has a significant difference from many common hacks: there is no need for direct penetration into the exchange server or the user's device. If the recovery phrase was generated insecurely from the start, an attacker can access the user's assets by reconstructing possibilities without physical access to the device.

For users, the message is clear; if a wallet has used a vulnerable infrastructure to generate its recovery phrase, creating a completely new wallet and transferring assets to it is the safest way to discard suspicious keys.