Drain Moves 9,408 SOL From 48 Bloom-Linked Wallets in 94 Seconds

A rapid drain tied to Bloom moved 9,408.23 tokens of Solana (SOL) from 48 wallets in 94 seconds late Sunday, with the traced outflows valued at about $953,000.

The transfers began at 9:03:07 p.m. ET Sunday, Oct. 25, and ended at 9:04:41 p.m. ET (01:03:07–01:04:41 UTC Monday, Oct. 26). The estimated value uses a SOL price of about $101.30 during the transfers. It is a gross outflow estimate, not a confirmed net-loss total.

A cutoff check at 3:34 a.m. ET (07:34 UTC) Oct. 26 showed that a second holding wallet contained 9,408.21 SOL and had not sent funds by that time. Bloom valued 9,408 SOL at about $947,000, compared with the roughly $953,000 estimate for the traced outflows.

The wallets were grouped into nine traders. Twenty-four had not traded through Bloom in the previous month, and five had last used the service between January and May 2025. The largest single withdrawal was 1,636 SOL, valued at about $166,000. Six wallets accounted for 61% of the SOL drained.

Each transfer was a standard SOL transaction signed by the sending wallet’s key. None involved a token approval, smart contract or additional signer. The transactions show that the transfers passed the wallets’ authorization rules, but do not establish how an attacker gained signing access.

“The record shows which wallets moved money and when. It does not show who controls the attacker's wallets or how the keys were obtained,” said Gaurav Agarwal of Bitquery Research.

Bloom attributed the drain to a remote code execution (RCE) vulnerability in a third-party module and said private keys were not compromised. The company pledged to reimburse affected users by sending funds to secure wallets they designate. The pledge was also part of Bloom’s explanation and reimbursement commitment.

Bloom counted 49 affected wallet addresses across nine users, while the tracing found SOL outflows from 48 wallets.