Traders Stopped Using a Crypto Bot but Their Old Wallets Were Still Drained

Bitquery’s Oct. 26 investigation traced 9,408 SOL, worth about $953,000 during the attack, from 48 wallets associated with the Bloom crypto trading bot. Half of those wallets had not traded through Bloom in the preceding month, and five last did so between January and May 2025. Bloom promised full reimbursement and later blamed a remote code execution vulnerability in a third-party module, a flaw that lets an attacker run unauthorized code in a software environment, while denying that private keys were compromised. Bloom reported 49 affected addresses across nine users, compared with Bitquery’s 48 drained wallets; the main drain ran from 01:03:07 to 01:04:41 UTC, under two minutes.