Key Highlights:
- Bloom announced the full reimbursement of nine affected users, refunding a total of 9,408 SOL across nine confirmed transactions following an exploit on Oct. 26.
- On-chain analysis by Bitquery revealed that 48 wallets were drained via plain SOL transfers signed solely by the affected wallets’ own keys, bypassing Bloom’s in-app 24-hour withdrawal lock.
- Half of the drained addresses had not been active on Bloom in the preceding month, highlighting the enduring security risks associated with lingering private key authority.
Bloom Reimburses 9,408 SOL Following Targeted Exploit
Following a rapid security incident on Oct. 26, trading platform Bloom announced that all nine affected users had been fully refunded, distributing a total of 9,408 SOL across nine linked reimbursement transactions. The incident led to two urgent considerations for cryptocurrency traders: immediate financial restitution for lost assets and the underlying mechanisms governing transaction signing authority on the Solana blockchain.
According to blockchain data analytics firm Bitquery, the malicious asset drains took place in a concentrated window between 01:03:07 and 01:04:41 UTC on Oct. 26. Bitquery identified that the exploit targeted 48 wallets grouped into nine distinct trader entities, linking all of them to Bloom via past fee-payment histories. Each transaction was executed as a standard SOL transfer authorized exclusively by the affected wallet’s own private key, without requiring secondary signers or token approval allowances.
Withdrawal Locks vs. Private Key Authority
The unauthorized transfers bypassed platform-level safety features, illustrating the functional limitations of service-side security settings. Bloom’s documentation instructs users to utilize a withdrawal address lock feature accessible via the “Withdraw” menu or the “/withdraw” command across its Extension, Manager, and Telegram interfaces. Under standard conditions, this mechanism prevents immediate redirection of withdrawals by enforcing a strict 24-hour cooldown period before any new destination address can be approved.
However, while Bloom’s lock secures the platform’s internal execution engine against unauthorized address changes, it cannot override basic blockchain mechanics. The Solana Foundation’s transaction guidelines state that any valid transfer simply requires instructions, a recent blockhash, and valid cryptographic signatures from the required authority accounts. Consequently, an entity possessing or capable of signing with the single private key controlling a wallet can broadcast a direct transfer to an external address on-chain, rendering application-level destination safeguards entirely ineffective.
Unresolved Questions Surrounding Key Management
Solana documentation distinguishes between holding a raw key locally and routing transaction approvals through automated key-management architectures or managed-wallet backends. Bitquery’s findings—which identified valid owner-key signatures on all drain transactions—stand alongside Bloom’s denial of any direct private-key compromise. Whether the attack stemmed from an exfiltrated private key or unauthorized exploitation of an internal signing pipeline remains the central technical question governing the breach.
Persistent Exposure in Inactive Wallets
The timeline of the targeted addresses reveals that security risks persist long after active trading stops. Bitquery discovered that 24 of the 48 compromised wallets had paid no trading fees to Bloom during the month prior to the attack, while five wallets had not generated fee activity since the period between January and May 2025. This dormancy confirms that dormant wallets retain critical exposure if their controlling keys remain accessible to an adversary.
Bitquery pointed to a similar precedent in the TradeWiz exploit on Sept. 30, which saw 20,793 Solana wallets swept of funds. In that incident, automated fee-paying trades ceased 41 minutes into the attack, yet the bot infrastructure accounted for 73% of the total SOL drained thereafter. Highlighting the extreme persistence of compromised credentials, Bitquery observed two TradeWiz addresses that received fresh deposits after the initial breach, only to be emptied again by the attacker within four seconds.
Why This Matters
This incident underlines a fundamental principle of self-custody and decentralized finance: changing passwords, logging out of an interface, or relying on application-level locks does not revoke underlying blockchain authority. Once a private key’s security boundary is breached, the governing authority over those funds remains permanently exposed.
For traders interacting with automated bots and trading tools, service-level repairs and destination locks only secure the surrounding workflow. Complete isolation from an exploited key requires transferring all assets to an entirely new, uncompromised wallet environment rather than re-funding or importing old credentials into alternative software.
Frequently Asked Questions
Why didn’t Bloom’s 24-hour withdrawal lock prevent the unauthorized transfers?
Bloom’s withdrawal lock is an application-level safeguard designed to prevent an unauthorized user from altering the saved payout destination inside Bloom’s trading interface. However, because the attacker was able to sign transactions using the wallet’s direct private key on the Solana network, the transfers were executed directly on-chain, bypassing the platform interface entirely.
How were affected users compensated by Bloom?
Later on Oct. 26, Bloom confirmed that all nine affected users had been fully reimbursed. The platform disbursed a cumulative total of 9,408 SOL across nine separate transactions directed to secure wallet addresses designated by the impacted traders.
What should users do if they previously utilized a bot wallet involved in a breach?
Users should immediately cease depositing assets into the exposed address and avoid simply importing the old private key or seed phrase into a different wallet application. The only definitive way to secure capital is to generate a fresh, uncompromised wallet key and migrate any remaining assets outside the authority of the compromised credential.
