The Bloom attacker moved nearly $1 million in stolen funds through a complex laundering pattern involving 2,152 unique intermediary and destination addresses, according to on-chain analytics firm Specter. The address breakdown includes 1,326 Solana addresses, 822 EVM addresses, and 5 Zcash addresses, with the transfer behavior suggesting the use of automated tools that repeatedly split, consolidated, and cross-chained assets. A portion of the stolen funds was bridged to Zcash for further obfuscation. Notably, 26.099 ZEC has already been deposited into the Sapling privacy pool, making those funds significantly harder to trace compared to transparent blockchain transfers.