Bloom Phishing Tool Steals Nearly $1 Million; Attacker Laundered Funds via 2,152 Addresses and Cross-Chain Transfers to Zcash

TechFlow news, Oct. 28 — According to on-chain analyst Specter (@SpecterAnalyst), the Bloom drainer (a phishing crypto-draining tool) has stolen nearly $1 million in assets and laundered the funds in a manner consistent with eight-figure illicit proceeds. Transfer patterns suggest the attacker may have used automated scripts, including repeated splitting, fund consolidation, and cross-chain bridge transfers.

The attacker used a total of 2,152 intermediary and destination addresses, including 1,326 Solana addresses, 822 EVM addresses, and 5 Zcash addresses. Some funds were transferred to Zcash via cross-chain bridges, with 26.099 ZEC entering the Sapling privacy pool, significantly increasing the difficulty of subsequent tracking.

Source: TechFlow