Bloom Trading Reports $947,000 Theft Due to RCE Vulnerability

Tokenpost

Bloom Trading Reports $947,000 Theft Due to RCE Vulnerability

First seen 27 Oct 2026, 01:26 UTC • •39.0

Article Content

1 / 3

Browse articles

ThreatCluster •October 27, 2026 at 07:12 UTC

•The theft involved 9,408 SOL, valued at approximately $947,000.
•The incident was caused by an RCE vulnerability in a third-party module.
•Bloom Trading has committed to reimbursing all affected users.

Bloom Trading reported a theft of approximately $947,000 in Solana (SOL) due to a remote code execution (RCE) vulnerability in a third-party module. The company confirmed that private keys were not accessed or leaked, ensuring the safety of unaffected wallets. The incident impacted nine users across 49 wallet addresses, with a total loss of 9,408 SOL. Bloom has temporarily taken its systems offline and is tracking the stolen assets while exploring recovery options. The company has pledged to fully reimburse the affected users. Users will need to log back into Bloom Manager and the Chrome extension once services are restored.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-26

Bloom Trading reports security incident

The company disclosed a theft of 9,408 SOL due to an RCE vulnerability in a third-party module, affecting nine users.

2026-10-26

Systems taken offline

Bloom Trading temporarily took all systems offline as part of their response to the incident.

More articles in this cluster (2)

Threat Graph

6 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Data Breach
Zero-day Exploit

Organization (1)

Bloom Trading

Weakness (1)

CWE-94 - Code Injection

Affected Platform (2)

Bloom Manager
Chrome Extension

Relationships

Data Breach targets Bloom Manager
Data Breach targets Chrome Extension
Zero-day Exploit targets Bloom Manager
Zero-day Exploit targets Chrome Extension
Data Breach related to Bloom Trading
Data Breach related to CWE-94 - Code Injection

Following this threat?

Track Bloom Trading in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

How much was stolen?

A total of 9,408 SOL, valued at approximately $947,000, was stolen.

Are my funds safe?

Bloom Trading confirmed that wallets outside the affected group remain secure.

What actions is Bloom Trading taking?

Bloom Trading is tracking the stolen assets and has pledged to fully reimburse the affected users.

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…