Official Statement | Security Incident Update TL;DR: No private keys were compromised, unaffected wallets are safe, and all affected users will be fully reimbursed by Bloom. Following our investigation, we have identified the exact attack vector and confirmed the scope of the incident. The attack exploited a third-party module through a complex Remote Code Execution (RCE) vulnerability. No private keys were accessed or compromised, and we have ruled out broader exposure of users' wallets. Incident Overview Affected: 49 wallet addresses belonging to 9 users. • Total losses: Approximately 9,408 SOL ($947,000). • Root cause: Exploited third-party module enabling an RCE vulnerability. • Refunds: Bloom will fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users. • We are also working to trace the stolen funds, explore recovery and freezing options, and identify the attacker. Our team has been developing software since 2018 and operating in crypto since 2021. We are an established team, committed to building for the long term and protecting the trust of our users. Security threats are an unfortunate reality of this industry, even with extensive precautions in place. Our commitment to user safety, transparency, and business continuity remains unchanged. The Bloom Team