On-chain tracking on Oct. 27 showed the wallet holding funds taken in the Bloom Trading exploit had begun sending out SOL, while about 9,388 SOL remained after the initial transfers. The movement came a day after Bloom said it would fully reimburse nine affected users, with Solana transaction data showing refund transfers had begun from the platform’s published address.
Blockchain analytics previously identified 9,408 SOL, worth roughly $950,000 at the time, as drained from wallets associated with the nine traders. Bloom has attributed the incident to an exploit involving a third-party module and said private keys were not compromised.
Third-party module exploit hit nine Bloom Trading users
Bloom Trading said in an Oct. 26 statement that nine users were affected by an exploit involving a third-party module. It also said no private keys were compromised and pledged to fully reimburse the users with fresh wallets.
According to Bitquery, the incident drained 48 wallets belonging to the nine traders in approximately 94 seconds.
The drained total was 9,408 SOL, worth about $950,000 at the time of the incident.
On-chain transfers show Bloom began reimbursing affected wallets
Bloom’s reimbursement pledge was followed by transfers from its published address to affected users. A Solscan-recorded transaction confirms one such refund.
Bloom has committed to covering the nine users in full, and the available transaction evidence establishes that reimbursements started. It does not, by itself, demonstrate that every affected user has received a full repayment.
Attacker begins moving SOL after the 94-second drain
The latest development is the movement of SOL from the attacker’s holding wallet. Coindaro reported on Oct. 27 that outbound transfers had begun, leaving approximately 9,388 SOL in the wallet after the first movements.
The movements coincided with the appearance of Bloom’s own refund transactions on Solana. The remaining balance was close to the 9,408 SOL identified as stolen in the initial drain, while the supplied tracking did not specify the destinations or purpose of the outbound transfers.
