Forty-eight wallets linked to Bloom, an automated trading service on Solana, lost 9,408 SOL between 01:03:07 and 01:04:41 UTC on Oct. 26, according to a Bitquery reconstruction. Each loss came through a plain SOL transfer signed only by the affected wallet’s key, with no second signer or token approval involved. Bloom denied that private keys had been accessed or compromised and blamed a remote-code-execution vulnerability in a third-party module, while saying unaffected wallets remained safe. Bitquery found that 24 drained wallets had not paid Bloom a trading fee in the previous month, including five whose last recorded fee payment was between January and May 2025. The 48 wallets were linked to nine traders, and Bloom later said all nine affected users had been fully refunded, totaling 9,408 SOL. Bloom’s withdrawal lock prevents changes to a saved withdrawal address and imposes a 24-hour cooldown after unlocking, but it is unknown whether the victims used it; a copied key could authorize transfers independently of that setting. Bitquery also cited a separate Sept. 30 TradeWiz incident involving 20,793 wallets, without establishing a shared cause. SOL traded at $96.44, down 3.6% over 24 hours, at the time of the report.