TLDR
- About 9,408 SOL, worth roughly $950,000 to $954,000, was taken from 48 to 49 Bloom Trading user wallets on October 26, 2026.
- Bloom has paused some services and says it is looking into a possible third-party compromise.
- The largest single loss was 1,636 SOL, valued at about $166,000. Some traders reported personal losses of up to $80,000.
- Bloom has promised to reimburse affected users by sending funds to new, secure wallets.
- Bloom generates and holds the private keys for user wallets, a custodial setup that critics say adds risk.
Users of Bloom Trading, a Telegram-based trading bot, say they lost nearly $1 million after a wave of wallet drains on October 26, 2026. The company has paused some of its services while it looks into what happened.
48 wallets were drained for $950k
all of them have at some point used @BloomTrading
weird drain, only targetted certain individuals and only drained SOL so left 6 figs in USDC in the wallets that were luckily saved by the victims pic.twitter.com/XUMBxA7dW3
— Inside Calls (@insidecalls) October 26, 2026
Bloom says it is investigating a possible third-party compromise. It has also promised to reimburse affected users.
What Happened to Bloom Users
About 48 to 49 wallets tied to Bloom users were targeted in the incident. The attacker reportedly took about 9,408 Solana, valued between $950,000 and $954,000 at the time of the drain.
The stolen funds were reportedly moved to a suspicious address. Losses were concentrated almost entirely in Solana. Some USDC held in the affected wallets was reportedly left untouched.
The damage was not spread evenly. The largest single loss was 1,636 Solana, worth about $166,000. Some well-known traders in the space said they lost as much as $80,000.
Several affected users blame weaknesses in the Bloom service itself. Some have urged others who still use the bot to pull their funds out right away.
Bloom has responded in three ways. It temporarily disabled certain functions, opened an investigation, and promised to reimburse users through newly created wallets.
The company says other wallets remain safe. It also says it is working to restore services and continue its investigation.
How Bloom Works
Bloom describes itself as a cross-chain trading automation tool. It runs inside Telegram and works on Solana and on chains that are compatible with Ethereum’s virtual machine. The company says it has been building software since 2018.
A key part of its design is custody. Bloom creates the private keys for its users’ wallets. That means the platform, not the trader, holds the master password.
Custodial trading bots have drawn criticism for this setup. Risks include keys being exposed through server storage and Telegram accounts being compromised.
Bloom has not said how the attacker got in. Until the investigation ends, that question remains unanswered.
The incident adds to ongoing safety concerns about custodial trading bots. It has been mentioned alongside other security breaches in the crypto sector.
Market data shows Solana trading at Rp1,824,689 on the Indonesian platform Pluang as of October 26, 2026 at 11:51 WIB. That was down 1.35% over the past day. About 77% of orders there were buy orders, with an average holding period of 72 days.
Bloom has not given a date for when reimbursements will arrive or when paused services will return.
Be the first to comment