Bloom · Breach

Bloom traces incident to RCE in third-party module

Oct 26, 2026 · 1 min read

Bloom said the attack exploited a remote code execution vulnerability in a third-party module. No private keys were accessed and unaffected wallets are safe. All affected users will be fully reimbursed.

By HIFY Radar newsroom Updated 10/26/2026 01:41 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Bloom, a crypto trading app, said an attack exploited a remote code execution flaw in a third-party module. According to the company, 49 wallet addresses belonging to 9 users were affected, with total losses of approximately 9,408 SOL ($947,000). Bloom denies that any private keys were accessed and pledges full reimbursement to affected users.

Why it matters

Clients suffered direct financial loss, and the product faces trust risk. The company claims unaffected wallets are safe and that broader exposure has been ruled out. The case shows the risk of third-party modules in applications that move funds.

What to do

Affected users should designate secure wallets with Bloom to receive reimbursement. Technical teams should inventory third-party modules with access to funds or keys in their own systems and review their exposure to remote code execution.

For the technical team

Affected: Bloom (app de trading) · Bloom (trading app). Third-party module name and version not disclosed.
Exploitation: Exploitation confirmed by Bloom through internal investigation: 49 wallet addresses belonging to 9 users attacked. No mention of public PoC, specific threat actor, or KEV listing.
Fix: The source cites no patch for the module and no fixed versions. Bloom's response: full reimbursement of 100% of stolen funds, tracing of the funds, exploration of recovery and freezing options, and attempts to identify the attacker.
Vector: Remote code execution (RCE) in a third-party module, described by Bloom as complex. The source does not detail the component, exact flaw type, or exploitation conditions.
More details: Losses of approximately 9,408 SOL ($947,000), according to Bloom's statement. The company says no private keys were accessed and broader exposure of users' wallets was ruled out. Bloom itself says it has developed software since 2018 and operated in crypto since 2021. Affected addresses were not individually listed.