Bitquery reports that 9,408 SOL were drained from 48 wallets linked to Bloom, an automated trading service, through transfers signed with the wallets’ own keys. Twenty-four of the wallets had paid no Bloom trading fees in the preceding month, showing that inactivity does not eliminate the risk to remaining funds. Bloom denied any compromise of private keys, attributed the incident to a remote-code-execution vulnerability in a third-party module and announced full refunds for all nine affected users. The precise mechanism that enabled the signing of transfers remains unresolved because locking the withdrawal address does not prevent a copied key from authorizing transfers to another destination.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
