Bitquery’s reconstruction reports that 48 wallets associated with Bloom, an automated trading service, lost 9,408 $SOL through transfers signed by the wallets’ own keys.

Bloom documents a lock that prevents changes to a user’s withdrawal destination, yet a copied key can authorize transfers outside that service interface.

In an Oct. 26 update, Bloom denied that private keys had been accessed or compromised. The account attributed the incident to a remote-code-execution vulnerability in a third-party module and said unaffected wallets were safe.Later on Oct. 26, Bloom announced that all nine affected users had been fully refunded, claiming a total of 9,408 $SOL and linking nine transactions.

That leaves two separate issues for users: compensation for the loss and the authority that could move funds from a wallet.