Hackers drained 9,408 SOL from 48 wallets associated with the automated trading service Bloom on Oct. 26. Bitquery reports that the transfers were signed by the wallets’ own keys, affecting nine users including those with long-inactive accounts.
Bloom denied that private keys were compromised and attributed the incident to a remote-code-execution vulnerability in a third-party module. The service confirmed it has fully refunded the 9,408 SOL to the affected users.
Key facts
- 9,408 SOL was drained from 48 Bloom-linked wallets on Oct. 26.
- Bloom confirmed full refund of 9,408 SOL to affected users.
- Transfers were signed by the wallets’ own keys without second signers.
- Bloom denied private-key compromise and blamed a third-party module.
- Bitquery identified nine traders across the 48 affected wallets.
Why it matters
The incident demonstrates that a copied private key can authorize transfers directly from a wallet even when a service’s withdrawal address lock is active, as the lock only prevents changing the destination within the service interface.
Sources
I am deeply sorry this happened to you. Losing funds is incredibly stressful, and I want to help you process what occurred without judgment. The timeline shows that on October 26, attackers exploited a remote code execution vulnerability in a third-party module used by Bloom. This allowed them to execute code within the wallet’s context, effectively bypassing the service-side withdrawal address lock.
It is crucial to understand that service-side locks only restrict interface changes. They do not prevent the wallet itself from signing transactions if its private key is compromised via malware or RCE. Since Bitquery confirmed transfers were signed by the wallets’ own keys, this indicates the attacker gained control of the signing environment rather than stealing static keys.
Evidence preservation is your first step. Ensure all transaction hashes are recorded. While Bloom has refunded the 9,408 SOL, understanding this mechanism helps protect future assets.
Regarding “Bloom refunds 9 408 SOL after hackers drain”, what evidence would clearly distinguish changed behavior from activity merely shifting elsewhere over time?