Solana Trading Bot Bloom Loses 9,408 SOL From 49 Wallets

Bloom, a Telegram trading bot for Solana and EVM networks, reported a breach on October 26: about 9,408 SOL, roughly $947,000, left 49 wallets belonging to nine users. Analytics account Onchain Lens flagged the transfers to a suspected drainer wallet at around 12:26 AM ET, and Bloom published its official statement at 5:12 AM ET.

Details

Bloom says the attack exploited a complex remote code execution (RCE) vulnerability in a third-party module. The company states that no private keys were accessed, that other users' wallets are unaffected, and that every affected user will be fully reimbursed.

Onchain Lens noted that the largest single drain was 1,636 SOL (about $166,000) and warned the final total could be higher. Bloom's confirmed figure remains 9,408 SOL, which crypto.news and AMBCrypto also report.

All Bloom systems are offline as a precaution. When service resumes, users will have to log in again to Bloom Manager and the Chrome extension. Bloom has not published a technical post-mortem or identified the attacker.

What it means for the market

Telegram trading bots sign or hold access to transactions on users' behalf, so a flaw in one component can expose many wallets at once. The "no keys were compromised" claim has not been independently verified, and Bloom has not explained how a third-party module could authorize the transfers.

The sum is small against the size of the SOL market, but the incident is a reminder of the risk of keeping significant funds in bot-linked wallets. For live prices and the daily brief, see the front page and the Solana page.

Full timeline — in our explainer.