Security

2026

Bloom

Solana

<h2 id="tldr">TLDR</h2>
<ul>
 <li>Bitquery reports that 48 wallets linked to the Bloom trading bot lost 9,408 SOL on Oct. 26.</li>
 <li>Each transfer was signed only by the wallet’s own key, with no second signer involved.</li>
 <li>Bloom denied that private keys were compromised and blamed a flaw in a third-party module.</li>
 <li>Half of the drained wallets had not paid a Bloom trading fee in the past month.</li>
 <li>Bloom says all nine affected users have been fully refunded.</li>
</ul>
Hackers drained 9,408 SOL from 48 wallets linked to Bloom, an automated trading service on the Solana blockchain. The figures come from a reconstruction by data firm Bitquery.
The funds were moved through transfers signed by the wallets’ own keys. The full drains took place between 01:03:07 and 01:04:41 UTC on Oct. 26.
Bitquery said each drain was a plain SOL transfer signed only by the affected wallet’s key. No second signer or token approval was involved.
In an Oct. 26 update, Bloom denied that any private keys had been accessed or compromised. The company blamed a remote-code-execution vulnerability in a third-party module.
Bloom also said that wallets not affected by the incident remain safe.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 Official Statement | Security Incident Update
 TL;DR: No private keys were compromised, unaffected wallets are safe, and all affected users will be fully reimbursed by Bloom.
 Following our investigation, we have identified the exact attack vector and confirmed the scope of the… <a href="https://t.co/llFHfzx6iG" rel="noopener noreferrer nofollow">pic.twitter.com/llFHfzx6iG</a>
 — Bloom (@BloomTrading) <a href="https://x.com/BloomTrading/status/2114646392010359238?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
 </blockquote>
</div>
<h2 id="how-bloom-s-withdrawal-lock-works">How Bloom’s Withdrawal Lock Works</h2>
Bloom’s FAQ tells users to keep their withdrawal address locked. While locked, the address cannot be changed, and unlocking starts a 24-hour cooldown.
The lock is meant to stop someone with access to a user’s account from redirecting withdrawals through the service. It is not known whether the victims had this lock turned on.
A copied private key works differently. Anyone holding the key could send funds to a new destination without changing the withdrawal address saved inside the service.
Bloom’s homepage says its Extension, Manager, and Telegram products share one execution engine. The same wallet key keeps the same control over funds no matter which interface uses it.
Solana’s documentation separates holding a key locally from requesting signatures through a managed wallet system. A valid owner signature could point to a copied key or to misuse of a signing path. It is still unclear which one happened.
<h2 id="old-wallets-were-also-hit">Old Wallets Were Also Hit</h2>
<a href="https://bitquery.io/investigations/tradewiz-hack" rel="noopener noreferrer nofollow">Bitquery found</a> that 24 of the 48 drained wallets had not paid a Bloom trading fee in the previous month. Five last paid a fee between January and May 2025.
Bitquery linked all 48 wallets to Bloom through past fee payments and grouped them into nine traders. It noted that two of those groups were identified mainly by the order of the drains.
A separate attack on the TradeWiz bot shows how this kind of exposure can last. Bitquery dates that main sweep to Sept. 30 and counts 20,793 wallets drained of SOL, though no shared cause with Bloom has been found.
In that case, two drained TradeWiz addresses received new deposits and were emptied again within four seconds.
The CryptoSlate report notes that users who fear a key was copied can move funds to a new wallet with a fresh key. Importing the old key into another app keeps the same risk in place.
Solana’s SOL token traded at $96.44 at the time of the report, down 3.6% over 24 hours.
Later on Oct. 26, Bloom announced that all nine affected users had been fully refunded. The company said the payments totaled 9,408 SOL and shared links to nine transactions.
The post <a href="https://blockonomi.com/hackers-drain-9408-sol-from-bloom-trading-bot-wallets-copied-key-blamed/" rel="noopener noreferrer nofollow">Hackers Drain 9,408 SOL From Bloom Trading Bot Wallets, Copied Key Blamed</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Hackers Drain 9,408 SOL From Bloom Trading Bot Wallets, Copied Key Blamed

Table of Contents

Blockonomi

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!