Skip to content
EVENT / TOPICHistorical

Hackers drain 9,400 SOL from bot wallets via copied private keys

1 reports1 sources10/30/2026 updated

Current overview (not historical)

AI overview

Hackers exploited a remote code execution vulnerability in a third-party module to copy private keys from 48 wallets associated with Bloom's automated trading system, resulting in the transfer of 9,408 SOL. According to Bitquery, the main transfer occurred on September 30, affecting 20,793 wallets. Bloom confirmed on October 26 that all nine affected users received full compensation, totaling 9,408 SOL.

Written with AI from the reporting · updated 10/30/2026

Latest developmentOct 30, 11:50
Hackers drain 9,408 SOL from 48 Bloom bot wallets via copied private keys
Explore the timeline, relations and evidence
Expand the detailed fact route and sources

Story route

A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.

  1. 1Unclassified fact stationOct 26, 00:00recorded Oct 30, 12:11single sourcerevised

    黑客通过复制密钥从48个Bot钱包中抽取9408 SOL

    Read original source ↗ CryptoSlateReplay this moment in the explorer
    Evidence & revisions · 1 source records
    Subject：
    Bloom
    Action：
    钱包资金被转移
    Object：
    9,408 SOL
    Occurred (fact side)：
    Oct 26, 00:00
    CryptoSlate ↗Report pageRevision 2 · currently revised
    Published (valid side)：
    Oct 30, 11:50
    First seen (known side)：
    Oct 30, 12:11
    Fact stationSingle source · one-sided claimRevised

    Copy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.

Uncertainty marks flag where to check the sources; they are not proven causation.

Report timeline

Explore every side through dated source reports.

Oct 30
  1. CryptoSlateRelated fact: single sourceSource report revised
    Hackers drain 9,408 SOL from 48 Bloom bot wallets via copied private keys

    Report first recorded Oct 30, 12:11

    Bitquery reports that 48 wallets linked to automated trading service Bloom lost 9,408 SOL through transfers signed by the wallets' own keys. Bloom attributes the Oct. 26 incident to a remote-code-execution vulnerability in a third-party module, denying private key compromise. All nine affected users were later fully refunded 9,408 SOL. The incident highlights that a copied private key can authorize transfers even when a withdrawal lock is active, as the lock only prevents address changes, not key-based outbound transfers.

    Read original source ↗

Event activity trend

Latest comparable
3
Comparable peak
10Oct 30, 13:00
24h change
-49%

The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.

Event discussion

Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.

Open GitHub Discussions