On July 6, 2026, the Bitcoin ecosystem accelerated synchronously on two completely different tracks. On one side, the security company Coinspect Security issued a public warning about the “Ill Bloom” wallet generation vulnerability: a hidden risk that had lurked across multiple chains since 2018 had been exploited by attackers on May 27th, draining hundreds of accounts of approximately $3 million. The security team pointed out that the affected wallets had continued to generate for several weeks prior, indicating that thousands of accounts were still on the edge of a cliff. On the other side, on the same day, the South Korean company Bitplanet signed a memorandum of understanding with Antalpha to introduce Bitcoin mining equipment worth 15 billion won, with an expected output of over seven Bitcoins per month in the first phase, intending to recognize the mined Bitcoins as operational income, to be managed as long-term financial assets—using a “mining-based reserve” approach instead of directly purchasing from the market. Amid the shadow of wallets being silently breached and funds being transferred along the chain, businesses are ramping up their computing power, attempting to incorporate Bitcoin into their financial reports and balance sheets. This scene, where security risks run parallel to institutional expansion, reminds us that we cannot ignore the underlying vulnerabilities of wallet technology while interpreting every on-chain anomaly, and we must also recognize the long-term institutional signals released by corporate mining layouts.
The Old Vulnerability Persists: ‘Ill Bloom’ Wallets are Still in Use
If the integration of Bitcoin into financial reports by companies is a public institutional experiment, then “Ill Bloom” seems more like an underground ghost that has lurked since 2018. Security institutions revealed that this wallet generation vulnerability is not a localized incident limited to a single chain or application, but affects wallets across multiple blockchains, with varying implementation methods but sharing the same weak point. The issue is not confined to one software client but is likely rooted in a deeper flaw in a type of wallet generation or implementation logic. What’s more troublesome is that, as of today, public information has yet to provide a complete technical rationale, a list of affected wallets, or the identity of the attackers, leaving it in a state of danger where the consequences are visible but the paths are unclear.
This danger was materialized on May 27, 2026, by a concentrated theft incident: it was disclosed that on that day, hundreds of accounts lost approximately $3 million due to the “Ill Bloom” vulnerability, indicating that attackers had clearly turned this hidden channel into a sustainable profit tool. Even more unsettling is that the security team pointed out in subsequent warnings that the affected wallets were still being generated weeks ago, meaning that thousands of accounts are still standing on the same fractured security line, just not yet triggered. This is not a historical bug review that has settled over time but a risk curve that continues to extend, directly overlapping with the on-chain addresses, fund paths, and account generation behaviors we observe, reminding the entire ecosystem that such long-term latent wallet risks must be treated as a real and ongoing issue they need to address.
From On-chain Theft to Security Stack: Where Users are Truly Exposed
The issue named “Ill Bloom” has been clearly pointed to by security companies as residing in the underlying “wallet generation” process rather than a frontend interface or a single application bug. Since 2018, it has quietly accompanied the birth of new addresses across multiple chains, and only on May 27, 2026, when hundreds of accounts were drained of approximately $3 million on-chain, did this technical discussion turn into real loss cases. The affected wallets had been continuously generated weeks ago, and thousands of accounts remained in a state of potential exposure, indicating that the risk does not belong only to a specific “problem wallet” but to any user who hands over key generation to tools with vulnerabilities. For individuals, once private keys and mnemonic phrases appear in an unsafe generation environment, all subsequent on-chain operations are built on a foundation that has already been hollowed out. For institutions using custodial or multi-signature wallets, the question arises as to how many layers of trust in their security stack are built on third-party key generation services or historical scripts.
More troublesome is that, to date, public information has not disclosed the specific technical rationale of the “Ill Bloom” vulnerability, a complete list of affected wallets, and the identity of the attackers remains unknown, with even a lack of clear evidence on whether there have been new large-scale theft incidents after May 27. In this state of incomplete information, users should not resign themselves to being “collateral damage,” but instead reassess their security priorities: avoid using wallet generation tools from unknown origins that lack auditing and community validation; be vigilant about mnemonic phrases generated on obscure plugins, scripts, or websites from earlier years, and try to migrate to more transparent and verifiable environments; institutions need to start from the key lifecycle, distinguishing between the “trustworthiness of the generation phase” and the “hardware protection in storage and signing phases,” treating wallets that have caused losses on-chain as a real issue that requires investigation from the bottom of the stack, rather than just surface-level fixes on the frontend interface and permission configurations.
Bitplanet Teams Up with Antalpha: Accelerating Mining
On the same day that security companies redirected their focus back to the key generation process, Bitplanet chose to double down on another “technical stack.” On July 6, 2026, Bitplanet signed a memorandum of understanding related to Bitcoin mining with Antalpha, planning to introduce mining equipment worth 15 billion won, and directly initiate comprehensive mining operations within the month. The approach is not a trial-like small-scale deployment but aims to quickly enter computing power competition by “prioritizing capacity.” In public data, this is seen as one of the first large-scale ventures into Bitcoin mining by a South Korean publicly traded company, indicating that Bitcoin is no longer just a speculative asset in financial reports but is starting to be included in the production segments and capital expenditure budgets of traditional enterprises.
More crucially, Bitplanet has clarified the positioning of this computing power in its financial and on-chain operations: the mining equipment in the first phase of the collaboration is expected to produce over seven Bitcoins per month, and the Bitcoins mined in the future will be recognized as operational income and managed as long-term financial assets, constituting a type of “mining-based reserve” path—exchanging equipment and electricity for native on-chain assets rather than passively purchasing them in the market. This arrangement essentially predefines the company’s positioning structure on-chain: the Bitcoins on future addresses are more akin to long-term reserves rather than high-frequency trading chips, representing the first systematic statement of South Korean capital towards Bitcoin mining as well as another expansion signal emerging in the Bitcoin ecosystem outside of security anxieties.
Mining-based Reserves Experimental Trial: Companies Lock Bitcoin into Financial Reports
By writing the Bitcoins mined in the future into operational income and categorizing them as long-term financial assets, Bitplanet effectively integrates “on-chain output” directly into its main narrative. In the past, when companies created financial reserves, they often did so by buying Bitcoin in the market with cash, more commonly seen as asset allocation or investment decisions; now, the collaboration is explicitly positioned as directly obtaining reserves through mining, with mining machines and electricity costs resembling production costs, while Bitcoin is the finished product. This shift from “buying assets” to “producing assets” has yet to reveal detailed financial terms in public information, but the direction is very clear: mining is no longer a marginal business but is being pushed into the core area of profit and balance sheets.
Once Bitcoin is written into operational income and “locked” within long-term financial assets, investors will no longer merely see a balance in an appendix, but a whole narrative surrounding the on-chain positions. On the income side, questions will arise about how Bitcoin production and price volatility affect the company’s performance rhythm; on the asset side, assessments will need to be made on whether these long-held Bitcoins represent stable reserves or high-volatility exposures. Since the specific accounting treatment and market acceptance of the “mining-based reserves” model have not yet been disclosed, this attempt currently appears more like an experimental positioning—companies are testing how to transform Bitcoin from a non-essential investment target into a core asset that must be seriously understood.
Risk and Expansion on the Same Stage: What Signals to Watch Next
Currently, the Bitcoin ecosystem is both addressing the “Ill Bloom” wallet generation vulnerability that has lurked since 2018 and welcoming Bitplanet and Antalpha's expansion path with a 15 billion won investment in mining equipment, expecting to produce over seven Bitcoins each month. These two threads are pulling at the narrative boundaries of the chain. The most direct signal from the security side is whether vulnerabilities like this, still viewed as not fully resolved as of July 6, 2026, are genuinely being contained—when the potential risk exposure of thousands of accounts will be identified and migrated, and whether new theft transactions and fund paths will appear on-chain will determine the minimum trust users have in the whole wallet generation tool. On the corporate side, attention should be focused on how far experiments like Bitplanet’s “mining-based reserve” can go: once the mined Bitcoins are recognized as operational income and included in the management of long-term financial assets, whether they will be retained on the balance sheet rather than quickly sold off, and whether this model of directly obtaining reserves through computing power, rather than market purchases, will be replicated by more institutions. What is truly worth observing is the speed and breadth of Bitcoin's transition in corporate ledgers from a marginal allocation to a core asset.
Join our community, let's discuss together and become stronger!
AiCoin Exclusive Hyperliquid Benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin Exclusive Aster Benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram Community: https://t.me/AiCoinWhaleData
On-chain Community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin On-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
