Wallet Drains Hit Telegram Bot BloomTrading: 9,408 Digital Assets Swept From About 49 Wallets

BloomTrading Suspends Services After Wallet Drains

Balances vanished from hot wallets tied to BloomTrading on Monday, 2026-10-26, and the team behind the cross-chain AI trading bot still cannot say how. BloomTrading runs a Telegram-based service that automates spot trading across Solana and EVM networks, and the failure reached the private keys it generates and holds on users' behalf. BloomTrading positions itself as a cross-chain automation platform, the kind of reach that atomic swap designs try to deliver without a custodian; in practice, the bot held the keys itself. The mechanism remains unconfirmed: the company says it is investigating, including whether a third-party vendor was breached. What the on-chain record does settle is scale. Monitoring of the suspected drainer addresses shows roughly 9,408 SOL, close to $954,000, gathered from about 49 victim wallets, with the largest single sweep near 1,636 SOL, around $166,000. The on-chain tracking thread Onchain Lens warns the final total may climb, and it has urged users to disconnect sessions and move any remaining funds. BloomTrading answered the same day: in a public reply on X, the official account said other wallets remain safe, suspended part of the service as a precaution, and asked users to open support tickets on Discord. A follow-up said the team has identified 9 affected users and will repay every confirmed loss in full, directly into new, secure wallets each user designates. It also stated it does not need a relief fund, because it will fund the repayments itself. The company rejected any suggestion of an exit scam. As of publication, the confirmed victim count stood at 9, with the team reviewing every wallet activity report it receives.

Nine Users, Forty-Nine Wallets

Accusations from users spread on social media while the investigation was still opening. One user posting under the handle @domyxbt described an $80,000 loss and asked for help reaching exchanges, tying the drain to a single transfer of about 640.45 SOL, near $64,000, to an address beginning 7kY8qx. In a later message the same user argued that roughly 95% of the missing funds trace back to Bloom, on the grounds that other hot wallets stayed untouched and no comparable bot had been used. BloomTrading's public position pushed back against the exit-scam reading: the team says it has built software since 2018 and would not trade its integrity for money, and that repayments come from the company itself rather than a relief fund. The structure under strain is the bot's custodial model. Products in this category routinely generate or hold private keys for their users, trading convenience for a single point of failure; when a vendor or an internal step breaks, every hot wallet the platform created is exposed at once. The recorded losses were almost entirely in SOL, with some USDC balances left untouched. Users are still advised to revoke any live connections to the bot and move balances they control into self-held storage. BloomTrading has kept parts of the service offline while the review continues, and Discord tickets remain the only official channel for affected users to register their cases. The outstanding questions are the ones the company itself lists: the root cause, the full extent of affected wallets, and delivery of the promised repayments. No timeline for a root-cause report has been published.

The gap that matters is nine against forty-nine. If BloomTrading's confirmed count lags the on-chain total, the repayment bill grows; if the two numbers rest on different definitions of an affected user, the root-cause report will have to reconcile them. A pledge to pay directly, without a fund, holds only if the final figure survives on-chain scrutiny. The structural point reaches past this one bot to the wider class of altcoin bot services that generate and store user keys: any Telegram service built that way concentrates the very risk its convenience is meant to remove. Until BloomTrading names its root cause, every deployment of that custodial design carries the same unanswered question.