Bloom says an RCE in a third-party module drained 49 wallets from 9 users
The trading bot says no private keys were exposed and users will be reimbursed.
Bloom (@BloomTrading) posted a security incident update on Monday. It says a remote code execution (RCE) flaw in a third-party module drained 49 wallets belonging to 9 users. Bloom says no private keys were exposed and all affected users will be fully reimbursed. The post drew about 550 likes.
The post does not name the third-party module or give the amount taken.
Why it mattersIt shows how a flaw in one dependency can put user funds at risk even when keys are not exposed.
