Bloom Trading Solana Bot Wallet Drain

On October 26, 2026, Bloom Trading, a Telegram-based Solana trading bot, lost approximately $947,000 (about 9,408 SOL) after an attacker exploited a remote code execution flaw in a third-party software module and drained 49 wallets belonging to nine users.

What happened

Bloom Trading is a Telegram bot that lets traders execute Solana swaps directly from chat, with wallet keys imported into the bot so it can sign transactions on users' behalf. On October 26, 2026, blockchain monitor Onchain Lens flagged a wave of suspicious transfers moving SOL out of wallets linked to the service, and Onchain Alert reported the funds being consolidated into a single suspected drainer address.

Bloom attributed the theft to a complex remote code execution (RCE) vulnerability in a third-party software module rather than a flaw in its own contracts or a mass key leak. The company said its investigation found no evidence that private keys were accessed or compromised and that wallets outside the affected group were safe, though it did not publicly explain how the unauthorized transfers were authorized. Investigators initially counted 49 victims; Bloom later clarified that the 49 drained addresses belonged to nine users. The single largest transfer was 1,636 SOL (roughly $166,000). Early on-chain parsing by Onchain Lens put the total near $954,000, which Bloom's own accounting narrowed to about $947,000. Notably, only SOL was taken — USDC balances in the affected wallets were left untouched.

Aftermath

Bloom took all of its systems offline as a precaution and pledged to reimburse 100% of the stolen funds, sending replacement SOL to secure addresses designated by the nine affected users. It rejected the idea of a community relief fund, saying it would cover the losses itself, but did not announce a payment schedule or confirm that refunds were complete. The team said it was tracing the funds and exploring freezing and recovery options while trying to identify the attacker. As of the initial disclosures, no funds had been reported recovered or frozen, no attacker identity had been established, and the third-party software provider had not been named.

Why it matters

Bloom's loss is the latest reminder that Telegram trading bots concentrate risk: to sign swaps automatically they hold or control user keys, so a single flaw anywhere in the bot's stack can drain many wallets at once. The pattern echoes the Banana Gun message-oracle drain and the Unibot router-approval bug, both of which emptied the wallets of a bot's users and ended in team-funded refunds. Here the entry point was not the bot's own code but a dependency — a reminder that outsourcing part of the stack does not outsource the blast radius. Convenience that requires surrendering key custody to an always-on service remains one of crypto's sharpest trade-offs.