Bloom Trading identified a third-party vulnerability behind the $947K theft and promised full user reimbursement.