Bloom trading bot wallets hack — October 2026

Bloom is a Telegram trading bot that creates and runs wallets for its users. Early on 26 October 2026 an attacker emptied 48 or 49 of those wallets on Solana, taking about 9,408 SOL. Bloom put the loss at about $947,000 across 49 addresses belonging to nine users; Bitquery, which traced the drains, counted 48 wallets and about $953,000. According to Bitquery, a script tested one wallet per trader and then emptied each trader’s wallets largest first, all within 94 seconds, including wallets that had not traded on Bloom since the first half of 2025. It took only SOL and left about $57,000 of USDC behind.

In its statement Bloom said the attacker exploited a third-party module through a remote code execution vulnerability, that no private keys were accessed and that unaffected wallets were safe. Bitquery found that every outgoing transfer was signed with the affected wallet’s own key, with no token approval or contract involved, which leaves open how the attacker was able to sign. Bloom took its systems offline while it investigated.

Bloom has promised to reimburse all of the stolen funds to wallets designated by the affected users. As of 28 October the attacker’s holding wallet still held the 9,408 SOL untouched, and no reimbursement had been confirmed as completed, so the outcome is left unresolved.