SOLANA·HUB
DE
Security Developing

9,408.23 SOL leaves wallets of Bloom users

Onchain Lens says 9,408 SOL left 49 Bloom user wallets on 26 October. Bloom names a vulnerability in a third-party module and pledges a full refund. The cause is Bloom's own statement.

SOLANA·HUB Editorial
Source: Onchain Lens

On 26 October, 9,408 SOL moved from wallets of Bloom trading-bot users to a collecting address, according to Onchain Lens. Onchain Lens counts 49 wallets and about $954,000.

A query of the public mainnet endpoint on 26 October shows 73 transactions on that address, from 1:59 a.m. to 5:30 a.m. Berlin time. Five of them failed. The inflows add up to 9,408.23 SOL.

The largest inflow was 1,636.02 SOL. Onchain Lens rounds that to 1,636 SOL, about $166,000.

At 5:30 a.m. Berlin time, 9,408.21 SOL moved to 6nYyCzJJzErbmfxvXqzbAqwoBzNvXUiwr15KCkcgmoe9. Another 0.02 SOL had already gone to a different address. At 9:13 a.m. Berlin time, the second address still held 9,408.21 SOL.

At 5:37 a.m., Bloom wrote of nine affected wallets and pledged a full refund into new wallets. At 7:05 a.m., Bloom said the 49 wallets belong to nine users. In that clarification, the pledge covers verified losses.

Bloom recommends moving any remaining balances to new wallets with newly generated private keys. The morning replies do not name a cause.

Update (26 October 2026): Bloom names a vulnerability in a third-party module

At 10:12 a.m. Berlin time on 26 October, Bloom named a cause. According to Bloom, the cause was a vulnerability in a third-party module that allowed remote code execution. That is Bloom’s own statement, not an independent finding.

Bloom says private keys were neither accessed nor compromised. According to Bloom, wider exposure of wallets has been ruled out.

Bloom confirms the scope as 49 wallet addresses of nine users. Bloom puts the loss at about 9,408 SOL, roughly $947,000. Bloom says it will refund 100 percent of the losses to wallets the affected users designate.

In the same thread, Bloom writes that all systems are offline as a precaution. Bloom says it will announce the restart through its own channels. After the restart, that post says, every user must sign in again to Bloom Manager and the Chrome extension.

That morning, Bloom had recommended moving any remaining balance to new wallets with newly generated private keys. In the statement, Bloom writes that wallets outside the 49 addresses face no further exposure.

At 1:41 p.m. Berlin time, Bloom offered confidential talks to the person Bloom holds responsible for the incident. According to that post, Bloom is willing to negotiate a partial return of the funds and, in exchange, to refrain from legal action Bloom can control. Bloom says this depends on applicable law and on terms both sides agree.

A query of the public mainnet endpoint at 3:21 p.m. Berlin time still showed 9,408.21 SOL at the second address. The latest transaction on that address was at 5:35 a.m. Berlin time.

What to watch

  • Whether Bloom pays the announced 100 percent
  • Whether Bloom names the third-party module
  • Whether the systems come back online
  • Which of the two wallet recommendations still applies
  • Whether the 9,408.21 SOL leaves the second address

Sources

#kurzmeldung #bloom #security #wallet

Related Articles