Late on Oct 25 (ET), on-chain watchers reported dozens of Solana wallets swept into one address within minutes. Many users tied the drains to the Bloom trading bot. In an official statement on Oct 26 (5:12 AM ET), Bloom says it has identified the attack vector: a third-party module exploited through a "complex Remote Code Execution (RCE) vulnerability."

• Scope (per Bloom): 49 wallet addresses belonging to 9 users, about 9,408 SOL (~$947,000). Bloom says no private keys were accessed and that it has ruled out broader exposure of user wallets.
• Response: Bloom will reimburse 100% of stolen funds to new wallets chosen by the affected users, and is tracing the funds and exploring freezes. All Bloom systems are offline as a precaution, and every user will have to log in again to Bloom Manager and the Chrome extension once service returns.

Not disclosed: which module was vulnerable, how it ran attacker code, and how funds moved without key access. Bloom's statement says only that no private keys were accessed or compromised. Earlier, Bloom advised moving remaining funds to fresh wallets with new keys. Users of any bot-custodied hot wallet should do the same and keep only trading float in them.