Hackers drain 9,400 SOL from bot wallets, and a copied key is blamed

Bitquery’s reconstruction reports that 48 wallets associated with Bloom, an automated trading service, lost 9,408 SOL through transfers signed by the wallets’ own keys.

Bloom documents a lock that prevents changes to a user’s withdrawal destination, yet a copied key can authorize transfers outside that service interface.

In an Oct. 26 update, Bloom denied that private keys had been accessed or compromised. The account attributed the incident to a remote-code-execution vulnerability in a third-party module and said unaffected wallets were safe.

Later on Oct. 26, Bloom announced that all nine affected users had been fully refunded, claiming a total of 9,408 SOL and linking nine transactions.

That leaves two separate issues for users: compensation for the loss and the authority that could move funds from a wallet.

Bloom’s FAQ tells users to keep their withdrawal address locked, saying that the address cannot be changed while locked and that unlocking starts a 24-hour cooldown before changes are allowed.

The withdrawal guide places Set Address, Lock Address, and Unlock Address in the Withdraw menu, accessible from the home screen or through the /withdraw command. The documented safeguard delays replacement of the destination used in that process.

The lock gives someone with a compromised service account a barrier against withdrawal redirection through that process.

Bloom’s product homepage describes the Extension, Manager, and Telegram products as sharing an execution engine. When the same wallet key is used through a different interface, it retains the same authority over the funds.

Bitquery reports that the full drains ran from 01:03:07 to 01:04:41 UTC on Oct. 26. It describes each as a plain SOL transfer signed only by the affected wallet’s key, with no second signer or token approval involved.

The Solana Foundation’s transaction documentation explains that a transaction carries instructions, signatures from the accounts authorizing the changes, and a recent blockhash. Its signing guide says every required signer must provide a valid signature.

For a wallet controlled by one private key, possession of that key gives control over its funds. An attacker who copied it could create a fresh transfer to a different destination without changing the withdrawal address saved inside a trading service.

Solana’s guide distinguishes holding a local key from requesting signatures through a key-management or managed-wallet backend. A valid owner-key signature can be consistent with copied key material or misuse of a signing path.