PLANET

Felix

Bloom

Solana

DEFI

On October 26, 2026, the BloomTrading cryptocurrency trading bot suffered a security breach that resulted in the theft of 9,408 Solana (SOL), worth approximately $954,000, from 49 user wallets. The largest victim lost 1,636 SOL, valued at about $166,000 at the time of the attack. Hackers specifically targeted accounts whose owners had imported their private keys directly into the trading platform.
<blockquote class="twitter-tweet">
 There won’t be any need for a relief fund. Bloom will fully reimburse all funds lost by the 9 affected wallets, directly to new, secure wallets designated by their respective owners.
 We’re still actively investigating the root cause, including whether a third-party provider may have been compromised, especially given the recent wave of security incidents across the industry.
 Our team has been building software since 2018. We’re well-established, here for the long run, and would never compromise our integrity for any amount of money.
 Our priority right now is to make every affected user whole, determine exactly what happened, and ensure it cannot happen again.
 — Bloom (@BloomTrading) <a href="https://x.com/BloomTrading/status/2114577183834280267?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
</blockquote>
 Following the attack, the BloomTrading development team <a style="color: #0000ff;" href="https://x.com/BloomTrading/status/2114577183834280267" rel="noopener noreferrer nofollow">suspended</a> several automated trading services to prevent further losses. The company also launched an investigation to determine whether the breach originated internally or involved a compromised third-party service provider.
Although the exact cause of the exploit remains unknown, BloomTrading has promised to fully compensate affected users. The platform has already verified nine affected wallets and plans to send reimbursements directly to new, secure wallet addresses created by the victims.
Read also: <a style="color: #0000ff;" href="https://defi-planet.com/2026/10/drift-hacker-moves-61m-in-eth-as-195m-remains-frozen/" rel="noopener noreferrer nofollow">Drift Hacker Moves $61M in ETH as $195M Remains Frozen</a>
<h3 id="span-style-font-weight-400-the-attackers-stole-sol-but-left-usdc-untouched-span">The attackers stole SOL but left USDC untouched</h3>
The stolen assets followed an unusual pattern. SOL disappeared quickly from the affected wallets, while stablecoins such as USDC remained untouched.
This selective theft suggests that the attackers may have used an automated script designed to transfer only native SOL. Moving other tokens may require additional transaction steps, more complex interactions, and transaction fees. A bigger attack could also have taken longer and increased the chances of triggering security alerts.
Some users had reported suspicious activity before the major theft. A trader named Felix <a style="color: #0000ff;" href="https://x.com/felixsama10/status/2114569429124042793" rel="noopener noreferrer nofollow">said</a> he had previously noticed small amounts disappearing from his balance without any corresponding trades.
His observation raises questions about whether the platform had experienced technical security issues before the attack or whether the hackers had conducted smaller test transactions before carrying out the larger theft.
<blockquote class="twitter-tweet">
 @domyxbt @BloomTrading Bloom Has a strange way of working, I had started using it and noticed money leaving my account and trades never being placed
 — felixsama (@felixsama10) <a href="https://x.com/felixsama10/status/2114569429124042793?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
</blockquote>
<h3 id="span-style-font-weight-400-private-key-exposure-raises-questions-about-who-takes-responsibility-span">Private key exposure raises questions about who takes responsibility</h3>
The incident highlights the security risks of trading bots that require users to import their private keys. Doing so gives the platform access to the funds controlled by those keys, creating a potential point of failure if its systems or connected services are compromised.
After a breach, determining responsibility can be difficult. Investigators must establish whether the platform’s infrastructure was compromised or whether individual users exposed their credentials through other means.
An X user, Domy, <a style="color: #0000ff;" href="https://x.com/domyxbt/status/2114529594942337103" rel="noopener noreferrer nofollow">claimed</a> that BloomTrading was responsible for draining $80,000 from their wallet and appealed for help contacting cryptocurrency exchanges. In response, Morgan <a style="color: #0000ff;" href="https://x.com/MorganJonesTale/status/2114538913847259400" rel="noopener noreferrer nofollow">argued</a> that blaming the platform immediately could overlook other possible causes, noting that some traders operate multiple trading terminals on unsecured computers. These devices could be vulnerable to malware that steals wallet credentials.&nbsp;
<blockquote class="twitter-tweet">
 @domyxbt @BloomTrading I mean bro you are just false accusing another platform of drainage with 0 evidence, who knows how much terminals you have on your computer
 I think instead of actively tweeting it was bloom try to do your due diligence and figure out the real suspect before false accusations
 — 𖤝 (@MorganJonesTale) <a href="https://x.com/MorganJonesTale/status/2114538913847259400?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
</blockquote>
<h3 id="span-style-font-weight-400-could-bloomtrading-s-refund-promise-encourage-riskier-trading-span">Could BloomTrading’s refund promise encourage riskier trading?</h3>
BloomTrading’s promise to fully compensate affected users has shifted attention from the stolen funds to how quickly victims can recover their losses. X user Txnvoid, who initially <a style="color: #0000ff;" href="https://x.com/txnvoid/status/2114529222417101138" rel="noopener noreferrer nofollow">expressed</a> shock after losing $77,000 and questioned how the theft happened, began <a style="color: #0000ff;" href="https://x.com/txnvoid/status/2114579738152907117" rel="noopener noreferrer nofollow">asking</a> where to claim a refund shortly after the company announced its compensation plan.
<blockquote class="twitter-tweet">
 i just got drained for $77,000 USD
 https://t.co/5oUnN4i6fv
 what the fuck just happened??
 — txnvoid (@txnvoid) <a href="https://x.com/txnvoid/status/2114529222417101138?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
</blockquote>
This reaction highlights a potential moral hazard in cryptocurrency trading. When users expect platforms to cover losses, they may become less cautious about the risks of importing private keys into third-party trading bots. If compensation becomes the expected response to security breaches, platforms may also face pressure to prioritize refunds without adequately addressing the vulnerabilities that caused the losses.
However, compensation alone does not resolve the underlying security problem. Until the breach is explained and the vulnerability addressed, traders remain exposed to similar risks. Meanwhile, CoinDCX recently <a style="color: #0000ff;" href="https://defi-planet.com/2026/10/coindcx-denies-new-16m-usdt-hack-allegations/" rel="noopener noreferrer nofollow">denied</a> allegations of a new security breach after blockchain investigators flagged approximately $16 million in Tether (USDT) transfers from wallets associated with the Indian cryptocurrency exchange
&nbsp;
Enjoyed this? Bookmark<a style="color: #0000ff;" href="https://defi-planet.com" rel="noopener noreferrer nofollow">DeFi Planet</a>, explore related topics, and follow us on<a href="https://twitter.com/PlanetDefi" rel="noopener noreferrer nofollow">Twitter</a>,<a href="https://www.linkedin.com/company/defi-planet/" rel="noopener noreferrer nofollow">LinkedIn</a>,<a href="https://www.facebook.com/DeFi-Planet-129907662611402" rel="noopener noreferrer nofollow">Facebook</a>,<a href="https://www.instagram.com/defi.planet/" rel="noopener noreferrer nofollow">Instagram</a>,<a href="https://www.threads.com/@defi.planet" rel="noopener noreferrer nofollow">Threads,</a> and<a style="color: #0000ff;" href="https://coinmarketcap.com/community/profile/DeFiPlanet/" rel="noopener noreferrer nofollow"> CoinMarketCap Community</a> for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
The post <a rel="noopener noreferrer nofollow" href="https://defi-planet.com/2026/10/bloomtrading-solana-bot-hack-drains-954k-from-49-wallets/">BloomTrading Solana Bot Hack Drains $954K From 49 Wallets</a> appeared first on <a rel="noopener noreferrer nofollow" href="https://defi-planet.com">DeFi Planet</a>.

BloomTrading Solana Bot Hack Drains $954K From 49 Wallets

Table of Contents

DeFi Planet

Other articles published on Oct 26, 2026

Join our free newsletter for daily crypto updates!