CryptoSlate
Bitquery reports that 48 Bloom-linked wallets lost 9,408 SOL in transfers signed by the wallets’ own keys on Oct. 26. Bloom denied that private keys were compromised, attributed the incident to a remote-code-execution vulnerability in a third-party module, and later said it had fully refunded nine affected users.
Why it matters
A withdrawal-address lock protects the destination used through Bloom’s withdrawal process, but it does not revoke a wallet key’s authority to sign a transfer through another route. Bitquery says the drains were plain SOL transfers with no second signer or token approval. Owner-key signatures establish that the wallets authorized the transfers, but do not by themselves show whether an attacker copied key material or abused a signing path.
The affected wallets were not all actively trading. Bitquery found that 24 had paid no Bloom trading fee in the preceding month, while five last paid one between January and May 2025. Funds left in a dormant wallet can remain exposed if its controlling key has been copied.
Market impact
Bloom says the nine affected users received a total of 9,408 SOL in refunds. That addresses their reported losses, but reimbursement does not establish how signing authority was obtained or whether the underlying exposure has been eliminated.
For users, the distinction is between changing access to a service and changing control over assets. A fresh wallet governed by an uncompromised key can remove funds from the old key’s authority; importing the same secret into another app does not. The exact signing route in the Bloom incident remains unresolved.
Frequently asked questions
-
How much SOL did Bitquery report was drained from Bloom-linked wallets?
Bitquery reports that 48 Bloom-linked wallets lost 9,408 SOL on Oct. 26.
-
What did Bloom say caused the incident?
Bloom denied that private keys were compromised and attributed the incident to a remote-code-execution vulnerability in a third-party module.
-
What does Bloom’s withdrawal-address lock protect?
The lock prevents changes to the withdrawal destination through that process. It does not prevent a wallet key from signing a transfer through another route.
-
Do the wallet signatures prove that private keys were copied?
No. The signatures show that the wallets authorized the transfers, but do not establish whether key material was copied or a signing path was abused.
-
Why can an inactive Bloom-linked wallet still be at risk?
Bitquery found that 24 affected wallets had paid no Bloom trading fee in the preceding month. If a controlling key has been copied, funds left in the wallet may remain exposed.
CoinDesk
CoinTelegraph
WatcherGuru
WuBlockchain
TheBlock