Bloom hack explained: how $947K in SOL was stolen

Overnight on October 26, about 9,408 SOL was drained from 49 wallets belonging to nine users of Bloom, a Telegram trading bot for Solana and EVM networks. Bloom itself puts the loss at roughly $947,000. The company blames a remote code execution (RCE) flaw in a third-party module and has pledged to reimburse victims in full. As of our latest check, the stolen coins are still sitting in an attacker-controlled wallet.

What we know now

• 49 addresses belonging to nine users were hit, with losses of about 9,408 SOL (~$947,000), according to Bloom.
• Bloom says the root cause was an RCE vulnerability in a third-party module. It states that no private keys were exposed and that other wallets are safe. It has not named the module or published a technical post-mortem.
• Bloom pledges to return 100% of the stolen funds to new secure wallets designated by the victims. It has not given a timeline for payouts.
• The full 9,408.21 SOL was moved in a single transfer to a second attacker wallet. On-chain data shows it was still there as of 2:15 PM ET on October 26, with nothing sent to exchanges, bridges or mixers.
• No freezes, bounty offers or attacker identification have been reported. Bloom says it is tracing the funds and exploring recovery and freezing options.

How it happened

Telegram trading bots hold users' wallets and sign trades on their behalf: the user types a command in a chat and the bot sends the transaction. A bug in a single bot component can therefore expose many wallets at once.

Bloom describes the attack as a "complex Remote Code Execution (RCE) vulnerability" in a third-party module, meaning the attacker was able to run their own code inside the bot's infrastructure. The company says the private keys themselves were not accessed. It has not explained how transfers from 49 addresses were signed in that case. There has been no independent confirmation of Bloom's account so far.

Timeline

October 25, 8:59 PM ET. Address 7kY8…p8BQ makes its first transaction. The main wave of transfers into it runs from 9:04 to 9:09 PM ET (Solana on-chain data).

October 26, 12:26 AM ET. Analytics account Onchain Lens reports that the address had collected 9,408 SOL from 49 Bloom users' wallets (worth about $954,000 by its estimate). The largest single loss was 1,636 SOL (~$166,000). It warns the final total could be much higher and urges users to move funds to fresh wallets.

October 26, 12:30 AM ET. The full 9,408.21 SOL moves in one transfer from the first address to a second one, 6nYy…moe9 (Solana on-chain data).

October 26, 5:12 AM ET. Bloom posts an official statement. It cites 49 addresses of nine users, about 9,408 SOL ($947,000), an RCE flaw in a third-party module, and no exposed keys. It pledges full reimbursement and says it is tracing the funds.

October 26, later in the day. Bloomingbit and Blockchain Reporter report that Bloom has temporarily taken its systems offline. Bloom's statement on X does not mention this.

October 26, 2:15 PM ET. The stolen SOL remains in the attacker's second wallet. Bloom has made no new statements.

Where the money went

So far the trail is short. Coins from the 49 wallets were pooled at one address. About three and a half hours after the attack, and minutes after the Onchain Lens post, the whole amount was moved to a fresh address. According to the block explorer, that address held 9,408.21 SOL as of 2:15 PM ET. We see no transfers to exchanges, cross-chain bridges or mixers. Stolen funds usually start moving later, which is why investigators and exchanges watch such addresses.

What the team and exchanges did

Bloom acknowledged the breach about eight hours after the attack and nearly five hours after the Onchain Lens post. It pledged to reimburse 100% of losses directly to wallets chosen by the victims and said it is working to identify the attacker and freeze the funds. The team stresses that it has been building software since 2018 and working in crypto since 2021.

As of publication, no exchange has announced a freeze, and there has been no public analysis from PeckShield, CertiK, SlowMist, Cyvers or ZachXBT.

What it means for holders

Bloom has promised victims a full refund but has not said when or how payouts will happen. It tells other users their wallets are safe, while Onchain Lens advised moving funds to fresh wallets not connected to the bot. The sum is small for the Solana market. The bigger open question is which third-party module was vulnerable and whether other bots rely on it.

For the first hours of the story, see our news report. For the live SOL price, see the Solana page.

This is not investment advice.

This story is developing: we are following events and adding new information. Last updated Oct 26, 2:30 PM ET.