TL;DR
- Bitquery traced 9,408 SOL, about $953,000, from 48 Bloom-linked wallets belonging to nine traders, with the full drain sequence completed in only 94 seconds.
- Every transfer was signed by the source wallet’s own key, showing valid cryptographic signing authority, although the investigation did not establish how the attacker obtained that access.
- Half the wallets had not traded through Bloom for a month, while five had been inactive since early 2025.
Bitquery traced a rapid coordinated drain involving Bloom trading-bot users on Solana, finding that 48 wallets belonging to nine traders lost 9,408 SOL, worth about $953,000. Its on-chain investigation found the transfers occurred in only 94 seconds on October 26. The incident combined concentrated wallet access with an unusually fast, scripted withdrawal sequence, highlighting custody risks around automated tools operating on the Solana blockchain.
Signed Transfers Leave the Root Cause Unresolved
The attacker first sent small test transfers from one wallet linked to each trader before beginning the main drain. Bitquery found the script then emptied wallets trader by trader, generally moving from the largest balance downward. The sequence indicates the attacker had organized the targeted wallets before executing the withdrawals, rather than discovering addresses randomly during the attack. Six wallets accounted for 61% of the stolen SOL, while the smallest loss among the nine traders was 650 SOL and the median drained wallet lost about $9,000 during the coordinated attack sequence. A similar emphasis on credential exposure has appeared in previous Solana trading-bot security incidents.
Every drain was a standard SOL transfer signed with the source wallet’s own key, with no token approval, smart contract or additional signer involved. Bitquery therefore concluded that whoever executed the transfers possessed signing authority for those wallets. The blockchain proves valid key-based authorization but does not establish how that authority was obtained. Bloom said it was investigating whether a third-party provider had been compromised, while the underlying cause remained unconfirmed.
The age of some affected wallets added another dimension. Half of the 48 wallets had not traded through Bloom during the previous month, while five had not traded through Bloom since the first half of 2025. Older wallet activity remained exposed despite long gaps in Bloom trading, reinforcing concerns around persistent credentials in automated services and echoing broader risks created when wallet access is compromised.
The attacker moved only SOL during the main drain, leaving roughly $57,000 in USDC behind. Almost all 9,408 SOL later sat in one holding wallet without moving further when Bitquery checked it. Bloom said it would fully reimburse affected users and paused trading after the incident. The case leaves the central security question unresolved: how signing access to wallets, including long-unused ones, became available to the attacker, a concern also seen in other automated-wallet breaches.
