Bloom Trading Bot: $947,000 in SOL Drained From Nine Users' Wallets in 94 Seconds

In the early hours of Monday 26 October 2026, money began leaving the Solana wallets of customers of Bloom, a trading bot that people run inside the messaging app Telegram. First came a handful of tiny test payments. Then the real withdrawals, one wallet after another, largest balance first. According to Bitquery, a blockchain data company that rebuilt the sequence, the whole thing was over in 94 seconds. Onchain Lens, an account on X that watches large transfers, flagged the outflows at 04:26 UTC.

The total was 9,408 SOL, the coin of the Solana network. Bloom valued it at about $947,000, which works out at roughly $100 a coin. Early estimates from the blockchain records put it at $953,000 to $954,000; the difference is the price of SOL at the moment each sum was counted. The largest single wallet lost 1,636 SOL, about $166,000. Almost all of the money landed in one receiving wallet, where Bitquery found it still sitting when it published its analysis.

How many victims

The first reports said 49 victims. That was a count of wallet addresses, not people. Bloom later said the 49 addresses belonged to nine users, because a single customer of a trading bot often runs several wallets at once. Bitquery counted 48 wallets that actually lost SOL. Neither Bloom nor Bitquery has explained the gap of one; the likeliest reading is that one address was touched but held nothing worth taking, but that is not confirmed. What every source agrees on is nine people and about 9,408 SOL.

The thief was selective. Only SOL was taken. About $57,000 in USDC, a stablecoin (a digital dollar issued by the company Circle), was left behind in the same wallets, according to Bitquery and the trade publication FinanceFeeds. USDC is the one asset in those wallets that its issuer can freeze, much as a bank can freeze an account, which is a plausible reason to leave it alone. Half of the 48 wallets, 24 of them, had not traded through Bloom in the previous month, and five had not been used with the bot since the first half of 2025. Old, forgotten balances were emptied alongside active ones.

What a trading bot is, and why it holds the keys

Bloom is one of a crowd of Telegram trading bots, alongside names such as Banana Gun, Maestro and BONKbot. They exist mostly for speed. Buyers of new memecoins, the joke tokens launched by the thousand every day on sites such as Pump.fun, compete to buy in the first seconds after a launch. Typing commands into a chat window and letting a bot place the order is faster than opening a normal wallet app and approving each trade by hand.

The price of that speed is custody. On Solana, money moves only when the owner of a wallet signs the transfer with a private key, a secret number that works like a signature and a PIN in one. A normal wallet app keeps that key on the owner's own phone or computer and asks before every payment. A trading bot cannot wait to ask. So when a customer signs up, a bot of this kind typically creates the wallet for them and keeps a copy of the key on the company's own systems, where its software can sign trades instantly. In stock-market terms, it is like giving a broker not just an account but a signed blank cheque book, so that orders never wait for a countersignature. Bloom also offers a Chrome browser extension and a web dashboard called Bloom Manager, and works on Ethereum, Base and BNB Chain as well as Solana.

That arrangement is why a problem at the bot company can become a problem in every customer's wallet at once.

Two accounts of how it happened

Bloom's account came in statements on 26 October. It said attackers had exploited "a complex remote code execution vulnerability in a third-party software module", meaning a flaw in a piece of software Bloom bought or borrowed from someone else that let an outsider run their own commands on Bloom's systems. It did not name the supplier or the module. It said: "No private keys were compromised, unaffected wallets are safe, and all affected users will be fully reimbursed by Bloom." It also said: "All Bloom systems are currently offline as a precautionary security measure."

Bitquery's reading of the blockchain sits awkwardly beside that. Every outgoing transfer, it found, was an ordinary SOL payment signed with the affected wallet's own key. There was no token approval (a standing permission letting another program spend the money), no smart contract (code that moves money by itself) and no extra signer involved. In plain terms, each payment carried a valid signature from each wallet's own key, which is what Bloom's own trading software would produce.

The two statements are not necessarily contradictory, and nothing published so far settles which way it went. A key can be stolen, copied off the server and used elsewhere. Or an intruder running commands inside the company's systems could have made Bloom's own software sign the payments without ever reading the keys out. The second possibility would square both accounts; Bloom has not said that is what happened. Bitquery itself noted that a valid signature proves the key was used, not how the attacker got the power to use it. DefiLlama, which keeps a public register of crypto hacks, has filed the case as a "supply chain attack", an attack through a supplier, which is Bloom's version, not an independent finding.

The promise and the precedents

Bloom says it will repay 100% of the stolen SOL itself, sent "directly to secure wallets designated by the affected users", with no community relief fund. It has given no date. It told customers to move any remaining money into newly created wallets, took every system offline, and said all users will have to log in again to Bloom Manager and the Chrome extension when service returns. The company says its team has been writing software since 2018 and working in crypto since 2021. It says it is tracing the money, looking at ways to freeze or recover it, and trying to identify the attacker.

Telegram bots have been here before. In October 2023 Maestro, an Ethereum bot, lost about $500,000 through a flaw in its trading contract and refunded 610 ether to users within hours. A week later Unibot lost about $640,000 through a flaw in its own trading contract. In September 2024 Banana Gun reported that 11 users had lost about $3 million, after attackers abused a weakness in how its bot handled messages, and it repaid them from its own treasury. In each case the company paid, and in each case the bots were back online soon after, with users once again handing over their keys.

The week was a bad one for third parties. Five days earlier, on 21 October, a thief drained about $371,000 from more than 200 wallets whose keys had been stored on Railway, a cloud hosting company that had just disclosed a breach. No source has linked that breach to Bloom, and Bloom has not named the supplier it blames.