Bloom Trading Bot

An attacker exploited a reported remote code execution vulnerability in a third-party software module used by Bloom’s trading infrastructure, enabling unauthorized transfers from user wallets. Approximately 9,408 SOL was drained from 48 wallets belonging to nine traders within 94 seconds.

Bloom attributed the incident to the third-party module and denied that private keys were exposed, while Bitquery confirmed that the transactions were signed using the affected wallets’ keys.