Solana Trading Bot Bloom Loses $954,000 in Wallet Drains, Pledges Full Reimbursement
Solana trading bot Bloom Trading said it suffered a hack on Monday, October 26, 2026, that drained about $950,000 worth of Solana from user wallets. The company said the attacker pulled funds from 49 wallets belonging to nine users.
The incident matters because of how the service is built. Bloom generates the private keys for its users' wallets, meaning the platform, not the trader, holds the master password. That design places the security of customer funds squarely on the company's own infrastructure rather than in the hands of individual account holders, and it is the reason a single breach could reach across dozens of wallets at once.
Scale of the Solana trading bot attack
Word of the breach surfaced on October 26, when Blockchain Reporter said Bloom had acknowledged a large outflow of Solana from customer wallets that day and had begun looking into what caused it. Crypto Briefing put the stolen amount at roughly 9,408 SOL taken from about 48 to 49 user wallets, a haul worth between $950,000 and $954,000 when the drains occurred.
BloomTrading operates as a Telegram-based trading bot, and its users reported combined losses approaching $1 million after the wave of drains on October 26, according to Crypto Briefing. The outlet said the stolen funds were made up almost entirely of SOL, while certain USDC balances sitting in the same compromised wallets were not touched, a pattern that left the stablecoin holdings intact even as the Solana balances disappeared.
Among those hit were traders with established reputations in the crypto space, some of whom said their individual losses ran as high as $80,000, Crypto Briefing reported. The outlet said those users directed blame at weaknesses in the Bloom service itself rather than at their own account practices, disputing any suggestion that the drains traced back to mistakes on the customer side.
Reimbursement pledge and paused services
In its response, Bloom committed to covering the losses of all nine affected users in full. The company said the compensation would be sent straight into new secure wallets chosen by the users themselves, and that it would make users whole directly rather than through a separate relief fund, a structure that puts the repayment obligation entirely on Bloom's own balance sheet.
While that promise was being made, Bloom also moved to contain the damage. The company suspended certain functions and opened an investigation into whether a third party had been compromised, according to Crypto Briefing, which reported that some services were paused as the inquiry got underway and that reimbursement would be routed through freshly generated, secure wallets.
The reception among customers was cool. Crypto Briefing reported that the service suspension did little to reassure traders who had entrusted the bot with access to their wallets, since the same mechanism that made the Solana trading bot convenient had also concentrated the risk. The outlet said the pressing issue for Bloom's users now is whether the company follows through on its pledge to repay them, noting that a commitment to make people whole counts only once the SOL actually arrives in the new wallets.
Unanswered questions over how wallets were drained
The explanation Bloom has offered so far, that a third party may have been compromised, leaves the central question open, according to Crypto Briefing. The outlet said users still do not know which door the attacker walked through, and it described that question as the one that remains central until the investigation concludes.
The answer will determine where responsibility falls. If the inquiry concludes that Bloom's own infrastructure was flawed, the responsibility for fixing it rests with the company, Crypto Briefing reported. If the trail instead leads to an outside party or to individual user accounts, the lessons extend well beyond this one Solana trading bot.
In the meantime, some of those who lost funds have warned fellow traders to act. Several affected users called on anyone still using the bot to withdraw their money without delay, Crypto Briefing reported, and the outlet said such warnings are likely to continue circulating as long as Bloom has not explained what went wrong.
Custodial key risks for Telegram trading bots
BloomTrading markets itself as an advanced cross-chain trading automation tool, according to Crypto Briefing. The service runs inside Telegram and works on Solana as well as EVM-compatible chains, and the company says it has been building software since 2018.
The custodial model at the heart of the service has long been a point of contention. Crypto Briefing reported that trading bots which hold user keys have faced criticism for exactly this arrangement, with identified risks including key exposure from server-side storage and compromised Telegram accounts. The outlet said the Bloom incident arrives while safety concerns about custodial trading bots are already running high, giving the breach an audience that extends past the nine users who lost funds.
The breach has been discussed in the company of other crypto security failures that expose the same underlying weakness, according to Crypto Briefing. The outlet also observed that, for a firm pointing to a building history stretching back to 2018, the updates Bloom delivers in the near term may define its reputation more than the previous several years combined.
Conclusion
Bloom Trading has confirmed that about $950,000 worth of Solana was drained from 49 wallets belonging to nine users on October 26, 2026, and has committed to repaying all of them in full through new secure wallets. The company has paused some services and is investigating a possible third-party compromise, though it has not yet identified how the attacker gained access. The next concrete step is the delivery of the promised reimbursements and the conclusion of Bloom's investigation, which users and affected traders are watching closely.
Frequently Asked Questions
How much was stolen in the Bloom Trading hack on October 26, 2026?
Bloom Trading said about $950,000 worth of Solana was stolen. According to Crypto Briefing, roughly 9,408 SOL was drained, valued between $950,000 and $954,000 at the time of the attack.
How many users and wallets were affected by the Bloom wallet drains?
Bloom said nine users were affected, with funds drained from 49 wallets belonging to those users. Crypto Briefing reported the figure as roughly 48 to 49 wallets tied to BloomTrading users.
Will Bloom reimburse users who lost Solana in the attack?
Yes. Bloom said it will fully reimburse all nine affected users, paying compensation directly into new secure wallets designated by the users, without setting up a separate relief fund.
What caused the Bloom Trading wallet drains?
The cause is not yet known. Bloom said it is investigating a possible third-party compromise and has paused some services, but according to Crypto Briefing the explanation does not yet show which door was opened.
Why do critics say Telegram trading bots like Bloom are risky?
Bloom generates the private keys for users' wallets, so the platform holds the master password rather than the trader. Crypto Briefing reported that custodial bots have drawn criticism for this structure, citing risks such as key exposure from server-side storage and compromised Telegram accounts.