Bloom Phishing Tool Steals Nearly $1 Million as Attackers Launder Funds Through 2,152 Addresses and Bridge to Zcash

On October 28, on-chain analyst Specter (@SpecterAnalyst) tracked the Bloom drainer (phishing tool), which had already stolen nearly $1 million in assets and laundered eight-figure proceeds. The transfer patterns indicate the attacker likely utilized automated scripts, involving repeated splitting, fund aggregation, and cross-chain bridge transfers.

The attacker has cumulatively used 2,152 intermediary and destination addresses, including 1,326 Solana addresses, 822 EVM addresses, and 5 Zcash addresses. Some funds have been transferred into Zcash via cross-chain bridges, with 26.099 ZEC entering the Sapling privacy pool, significantly increasing the difficulty of future tracking.