BloomTrading Wallet Drain: 9,408 SOL Lost in Oct. 26 Attack

BloomTrading, a Telegram-based trading bot, lost about 9,408 SOL from user wallets on October 26, 2026, with the haul valued at roughly $950,000 to $954,000 at the time of the drain, Cryptobriefing reported. The team has paused some services and says it is investigating a possible third-party compromise.

News.bitcoin reported that Bloom traced the entry point to a remote code execution (RCE) vulnerability involving a third-party software module, and that the company narrowed the victim count from an initial 49 wallets to nine users controlling 49 wallet addresses. Coincentral said the affected accounts ranged from 48 to 49 wallets.

Key facts

• The drain occurred on October 26, 2026, moving about 9,408 SOL valued between roughly $950,000 and $954,000.
• News.bitcoin cited Bloom’s own figure of approximately $947,000, against early on-chain estimates closer to $954,000; Coincentral put the range at $950,000 to $954,000.
• Bloom attributed the breach to a third-party RCE vulnerability and said no private keys were compromised.
• The largest single loss was 1,636 SOL, worth about $166,000, according to Coincentral and News.bitcoin.
• Bloom pledged to reimburse 100% of stolen funds to new, secure wallets designated by affected users.

How the reports differ on scope and mechanism

Much of the discrepancy sits in the victim count. Cryptobriefing and Coincentral described roughly 48 to 49 affected wallets, while News.bitcoin reported that Bloom’s investigation later settled on nine users behind those addresses. Bloom has not publicly disclosed the precise mechanism used to authorise the transfers, which is the central open question given its claim that keys stayed secure.

Losses were concentrated almost entirely in SOL, and some USDC balances in the affected wallets were reportedly left untouched. Individual damage varied widely: some traders, including well-known names, cited personal losses as high as $80,000, while the single biggest drain was 1,636 SOL.

The custody question underneath the breach

Bloom generates the private keys for its users’ wallets, so the platform, not the trader, holds the master password. The bot pitches itself as a cross-chain automation tool running inside Telegram on Solana and EVM-compatible chains, and the company says it has been building software since 2018 and has operated in crypto markets since 2021, according to News.bitcoin.

The structure has drawn criticism because key exposure through server-side storage and compromised Telegram accounts are persistent risks. Onchain Lens flagged the suspicious transfers, and Onchain Alert said the attacker consolidated funds into a suspected drainer wallet, warning that the final figure might be higher.

Why it matters

For users who handed Bloom control of their keys, the reimbursement promise is the only near-term remedy, and it has not been matched by a deadline or a restoration schedule. Several affected traders have urged others still using the bot to withdraw funds immediately. The incident also lands during a stretch of system bugs, breaches and hacks across crypto, a pattern News.bitcoin noted alongside speculation that AI-assisted tooling is widening the attack surface.

What to watch

Bloom’s investigation update will decide whether the flaw sat in its own infrastructure or with a third party. Watch for confirmation that the SOL has actually landed in replacement wallets, and for the company’s announcement on when suspended services and required re-logins resume.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: Crypto Briefing, News.bitcoin, Coincentral