Bloom Trading Bot Hack Drains $953K From 48 Solana Wallets in Just 94 Seconds

Bloom, a Telegram-based cryptocurrency trading bot, suffered a major security incident on October 26, 2026. Attackers drained approximately $953,000 in Solana (SOL) from 48 wallets in just 94 seconds.

The affected wallets belonged to nine traders, according to blockchain transaction analysis. Bloom has pledged to reimburse all affected users while investigating the incident, including whether a third-party service provider experienced a security breach.

Attackers Execute Rapid Solana Wallet Drain

Blockchain records show that attackers transferred approximately 9,408 SOL from wallets associated with Bloom. The operation followed a coordinated pattern, suggesting the use of an automated script.

The attackers first conducted small test transactions before targeting wallets with larger balances. They then systematically emptied the accounts, completing the main operation within 94 seconds.

One wallet lost approximately 1,636 SOL, worth around $166,000 at the time. Meanwhile, six wallets accounted for roughly 61% of the total stolen cryptocurrency.

Interestingly, the attackers targeted SOL holdings while initially leaving approximately $56,853 in USDC untouched. One affected trader subsequently transferred about $49,000 in USDC to safety before another attempted withdrawal succeeded.

Bloom Promises Full Reimbursement

Bloom responded to the incident by promising to reimburse the nine affected traders. The platform said it would transfer replacement funds to new wallets designated by their owners.

The company also indicated that it was investigating a potential compromise involving a third-party provider. However, the precise cause of the incident remains unconfirmed.

Bloom has maintained that its private keys were not compromised. Nevertheless, blockchain analysis identified transactions authorized using the affected wallets’ private keys, raising questions about how attackers obtained signing access.

Investigators have not established whether the credentials originated from Bloom’s infrastructure, an external provider, or another source.

Security Concerns Grow Around Crypto Trading Bots

The incident highlights security risks associated with automated cryptocurrency trading services. These platforms often maintain access to users’ wallet credentials to execute transactions quickly.

Blockchain analysis also revealed that several affected wallets had remained inactive on Bloom since early 2025. This suggests that previously used trading wallets may remain vulnerable when their private keys are exposed.

As of the investigation’s October 26 snapshot, approximately 9,408 SOL remained in an attacker-controlled wallet without further transfers.

Bloom’s reimbursement commitment could help affected traders recover their losses. However, the incident underscores the importance of protecting private keys and limiting funds stored in wallets connected to automated trading platforms.