Bloom Trading Bot Drained of 9,408 Solana (SOL) Worth $947,000

49 Wallets Drained of 9,408 SOL

An attacker drained 9,408 Solana (SOL) from wallets tied to Bloom Trading, a Telegram-based AI trading bot serving Solana (SOL) and Ethereum Virtual Machine users, in an incident the company dated Monday, October 26. At the Solana (SOL) price of that moment, Bloom’s own accounting put the haul at roughly $947,000, while earlier estimates built from blockchain data ran closer to $954,000. The gap is small, but the two figures come from different methods: the first from the company’s internal review, the second from early on-chain analysis. The record itself settles the shape of the theft. Monitoring activity flagged the suspicious transfers on X as they moved, and on-chain observers cautioned that the final count could climb above the first tally. The stolen coins were pooled into what trackers described as a suspected drain wallet, and the largest single loss came to 1,636 Solana (SOL), worth about $166,000. Early reads also indicated the attacker went after SOL balances while leaving some USDC holdings untouched, a pattern consistent with a scripted sweep rather than hand-picked targets. The victim count shifted as the review progressed: initial on-chain counting suggested 49 separate victims, and Bloom’s follow-up narrowed that to 9 users who together controlled the 49 affected wallet addresses. What the record does not settle is how the transfers were authorized, and that is the part of the incident still waiting on the company’s disclosure.

Bloom Halts Services, Promises 100% Refunds

Bloom’s response, laid out in statements on X, separates what the company says was exposed from what it says stayed safe. In its public account, no private keys were compromised, unaffected wallets remain secure, and every affected user will be compensated in full, with the team’s statement on X committing to refund 100% of the stolen funds directly to wallets each affected user designates. The entry point, per Bloom’s investigation, was a sophisticated remote code execution (RCE) flaw involving a third-party software module, a class of bug that lets an attacker run commands inside an infected environment without ever extracting a user’s key. That distinction carries real weight: an RCE path can produce unauthorized transfers while keys stay in place, which is why the company treats key safety and the missing coins as two separate problems. Bloom has not yet disclosed the specific mechanism that authorized the transfers. Operationally, the platform, used for spot trading on the networks it supports, took all Bloom systems offline as a precautionary security measure. Services stay down until the team completes a secure restoration, after which users must re-authenticate on Bloom Manager and the Chrome extension before resuming normal use, with the all-clear to come through official channels. The company says it is tracking the stolen coins, weighing freeze and recovery options, and working to pin down the attacker, and it leaned on its record, citing software development since 2018 and crypto-market operations since 2021. Affected users were advised to move whatever assets remain into freshly generated wallets, a migration our ranked overview of the 11 best Solana wallets in 2026 is built around. What Bloom has not provided is a compensation deadline or a date for restored service.

The Open Question in Bloom’s Post-Mortem

The breach is an application-layer failure, not a fault in the Solana (SOL) network itself, and the on-chain record already fixes its scale: 9,408 SOL out of 49 wallets. What the post-mortem does not yet fix is the authorization path. Until Bloom publishes that mechanism, the assurance that unaffected wallets are secure rests on the company’s own statement rather than on disclosed evidence. The episode is also a reminder that custody through an altcoin trading interface concentrates risk in precisely the software layer that failed here: the practical divide for users runs between keys a bot holds and keys only the owner controls, the trade-off between bot-managed accounts and a hardware wallet. Context adds one more layer. Solana adoption metrics keep setting records, with tokenized stock holders hitting 1.5 million, an all-time high, even as Solana ETFs shed $17.3 million in a recent stretch of flows. The trust question this incident raises sits apart from those numbers, in the small trading tools that still hold user funds between trades.