Bloom trading platform exploited via third-party RCE vulnerability, draining 9,408 SOL from 9 users; company pledges full reimbursement.
Security & Exploits ·
Bloom, a trading platform on Solana, disclosed that a remote code execution vulnerability in a third-party dependency led to the compromise of 9,408 SOL held across 9 user accounts. The company committed to reimbursing all affected users for their losses stemming from the incident.
The attack exploited a weakness outside Bloom's own codebase—specifically in an external component the platform relied upon. Remote code execution vulnerabilities allow attackers to run arbitrary commands on a system, and in this case, the flaw enabled unauthorized access to user funds stored on the platform. Such third-party dependencies are common in software development but can introduce unforeseen security risks if not properly audited or kept current.
The full scope of the exploitation and the timeline of discovery remain unclear from available disclosures. Details about how quickly Bloom identified the breach, whether user assets have been recovered, and the mechanism by which reimbursement will be processed have not been specified in public statements. The incident underscores the broader challenge crypto platforms face in managing risks across their entire technology stack.