Hackers drain 9,408 SOL from 48 Bloom bot wallets via copied private keys

Bitquery reports that 48 wallets linked to automated trading service Bloom lost 9,408 SOL through transfers signed by the wallets' own keys. Bloom attributes the Oct. 26 incident to a remote-code-execution vulnerability in a third-party module, denying private key compromise. All nine affected users were later fully refunded 9,408 SOL. The incident highlights that a copied private key can authorize transfers even when a withdrawal lock is active, as the lock only prevents address changes, not key-based outbound transfers.