On October 28, on-chain analyst Specter disclosed that a tool known as Bloom drainer, alleged to be specifically designed for phishing and stealing crypto assets, is suspected to be involved in a nearly one million dollar scale theft and laundering incident. Public on-chain records show that the attacker rapidly split and distributed the stolen funds into approximately 2,152 addresses, including around 1,326 Solana addresses, about 822 EVM ecosystem addresses, and 5 Zcash addresses, frequently relaying and consolidating along the way, quickly constructing a multi-chain intertwined funding maze. Some assets were subsequently transferred across chains to the Zcash network, with about 26.099 ZEC sent into the privacy pool based on zero-knowledge proofs, and once entering this privacy pool, the traditional tracking paths based on a public ledger are almost completely severed. This article revolves around this automated money laundering path driven by Bloom drainer, paved with nearly a million in stolen funds, attempting to restore how the attacker used address splitting and cross-chain scripts to counter on-chain analysis, and why privacy networks are once again in the spotlight.
Bloom Phishing Tool Becomes New Focus of Attacks
Prior to being named by on-chain analysts around October 28, the so-called drainer had long been a high-frequency tool in recent on-chain attacks: attackers no longer develop malicious contracts from scratch but instead directly use existing "drain scripts," requiring only an interface to induce user signatures, which can automatically sweep transferable assets once authorized. Bloom drainer emerged under such circumstances, described as a tool specifically for phishing and stealing crypto assets. Public information currently only confirms that it belongs to the drainer category, with specific methods of inducing users and presenting malicious operations on the front end still undisclosed, but it has been observed on-chain as a component of the crime and is estimated to have stolen nearly a million dollars in assets, a number sourced singularly with moderate credibility.
The reason Bloom drainer quickly became the focal point of a new round of attacks is highly related to the risk exposure method of current multi-chain wallet users. In other incidents, the trend of drainer attacks targeting multi-chain wallets has been mentioned several times: once users sign extensive authorizations for "unified management of multi-chain assets," the same set of keys often controls addresses on multiple networks, and a single erroneous signature could affect the entire asset portfolio. Bloom has been identified as a phishing tool involved in multiple wallet thefts, amplifying this concern further—victim groups are likely concentrated among users who are accustomed to cross-chain operations and rely on large authorizations to simplify tasks, while the precise number of victims and the scale of losses per wallet have not yet been disclosed in current public information, making Bloom more like a sample placed on the table: it reminds the market that when tool-based drainers are combined with multi-chain authorizations, any seemingly ordinary signature could become a weak link in the entire asset chain.
2152 Address Split Moves Solana and EVM
According to a single source, nearly a million-dollar level of stolen funds has been split between as many as 2,152 addresses, with approximately 1,326 belonging to the Solana ecosystem, about 822 to the EVM ecosystem, and another 5 Zcash addresses participating. The funds were not simply "in and out," but were repeatedly split, reorganized, and consolidated across multiple chains, presenting a highly structured "mesh" form: some addresses were specifically responsible for the initial round of dispersion, others for relay forwarding, and a few addresses undertook consolidation and cross-chain jumping roles, with Solana and various EVM chains bearing most of the relay pressure, forming a roadmap clearly designed for multi-chain environments.
On-chain analyst Specter pointed out that this operational path looks more like a pre-set money laundering template for "eight-digit scale stolen funds" rather than a random temporary solution. Coordinating over two thousand addresses in a short time is difficult for humans to maintain such frequency and consistency; large-scale address splitting and consolidation almost certainly rely on the operation of automation scripts behind it, demonstrating a complete set of tool-based, modular multi-chain transportation capabilities exhibited by Bloom drainer related attackers, rather than a one-time opportunistic probe.
Cross-Chain Zcash: 26 ZEC Infiltrates Privacy Pool
After completing the multi-chain splitting and consolidation, the attackers chose the "last hop" on the Zcash network. According to AiCoin data, part of the stolen funds was cross-chain transferred and split into at least 5 Zcash addresses, then uniformly converted into approximately 26.099 ZEC, which were finally injected into Zcash's Sapling privacy pool. Sapling relies on zero-knowledge proofs to hide transaction details, and once assets enter this privacy pool, only a "shell layer" of fund inflows and outflows remains on the public chain, with the specific destinations and routes of further splitting and consolidation virtually no longer visible externally.
This cross-chain operation to the privacy network actively "cuts off" the funding path related to Bloom drainer on-chain. According to public data, privacy assets have been indicated to serve as a "money laundering endpoint" in multiple historical cases—in the view of legitimate users, this is a tool for protecting personal financial privacy, whereas in the eyes of trackers, it is a barrier that cuts off visible paths and halts on-chain evidence collection. On the Bloom path, the Sapling privacy pool plays such an endpoint role, consolidating the attacker’s anonymity while pushing the potentially replayable multi-chain trajectory into an almost irretrievable gray area.
Automated Money Laundering Scripts and Pull of On-Chain Tracking
In the Bloom incident, what is actually countering the analysts is a set of nearly fully automated "money laundering scripts." According to AiCoin data, on-chain analyst Specter identified concentrated abnormal behaviors in 2,152 addresses by monitoring multi-chain address changes, of which 1,326 are distributed in the Solana ecosystem, 822 belong to the EVM ecosystem, and another 5 point to Zcash. The script generates and recycles addresses in bulk while completing splitting, consolidation, and cross-chain actions according to preset logic, forming seemingly unrelated short paths in an attempt to dissolve the profile of a single attacker in the ocean of addresses.
For trackers, the only way to counter is to piece these fragments back into a complete picture. Address clustering allows analysts to infer which apparently independent wallets actually belong to the same set of Bloom attack paths from similar usage patterns and synchronous send-receive rhythms; cross-chain path analysis restores parts of the funding trajectory traveling from Solana, through EVM networks, to Zcash along bridge contracts and relay addresses. But once approximately 26.099 ZEC are deposited into the Sapling privacy pool, this trajectory abruptly halts, and public on-chain data is cut off at the privacy pool stage, once again highlighting the tension between transparent auditing and personal privacy protection, while no confirmed cases of successfully freezing or recovering this batch of assets have emerged in the current public information.
From Bloom Lessons to User Self-Protection Checklist
Reflecting on the path of Bloom drainer, a wallet that uniformly manages multi-chain assets, one or two incomprehensible authorization signatures, combined with a set of tool-based drainer scripts, can push assets to 2,152 relay addresses, cross-chain to Solana, EVM, and even Zcash, ultimately "disappearing" in the Sapling privacy pool. In the absence of public victim relief and compensation information in this case, and no clear results of recovery appearing, prior protection is almost the only variable ordinary users can control: before connecting to any DApp or "airdrop website," verify the link source and domain, and preferably navigate from official channels; when signing, clearly understand the content, be cautious of incomprehensible authorizations, long-lasting or "unlimited quota" permissions; faced with unknown contracts and minting pages of unclear origin, even with a familiar wallet interface, the first choice should be to refuse. For high-value assets, avoid concentrating them in a single multi-chain wallet; instead, appropriately distribute them across different addresses and usage scenarios to prevent a single mistake from affecting the entire portfolio. At the same time, actively follow and educate oneself on warning information related to drainers and basic security, turning "verify signatures, be cautious of links, distribute assets" into a daily habit may help keep one off the victim list before the next similar tool-based attack like Bloom arrives.
Join our community, let's discuss and grow stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
