Bitquery's analysis found that 48 wallets linked to Bloom, an automated trading service, lost a combined 9,408 SOL through transfers authorized by the wallets' private keys on October 26.
The drain occurred in two minutes, with transactions running from 01:03:07 to 01:04:41 UTC. Each transfer was signed solely by the affected wallet's key, with no additional signers or token approvals required.
Bloom's Response and Refund
On October 26, Bloom denied that private keys had been accessed or compromised. The company attributed the incident to a remote-code-execution vulnerability in a third-party module and stated that unaffected wallets remained secure.
Later that same day, Bloom announced it had fully refunded all nine affected users, totaling 9,408 SOL across nine transactions. The company said reimbursements would go to secure wallets designated by the affected users.
Withdrawal Lock Protection and Its Limits
Bloom provides a withdrawal lock feature designed to prevent unauthorized changes to a user's withdrawal destination. According to Bloom's documentation, a locked withdrawal address cannot be changed, and unlocking initiates a 24-hour cooldown before modifications are allowed.
However, this lock operates only within Bloom's service interface. A copied private key retains full authority over wallet funds across all interfaces. An attacker with access to a private key could initiate direct transfers without changing the withdrawal address stored in Bloom's system.
Wallet Age and Lingering Risk
Bitquery found that 24 of the 48 affected wallets had not paid a Bloom trading fee in the preceding month, while five had not paid fees since between January and May 2025. This suggests that dormant wallets remained vulnerable if their private keys had been compromised.
For users with potentially exposed keys, moving assets to a fresh wallet controlled by an uncompromised key is necessary to prevent future unauthorized transfers. Simply changing service access credentials or reimporting the same key into another application preserves the attacker's authority over those funds.
