BloomTrading Wallet Drain: 9,408 SOL Stolen From Nine Users

BloomTrading has promised full reimbursement after 9,408 SOL was drained from 49 addresses belonging to nine users. Its security update attributed the incident to a remote-code-execution vulnerability in a third-party module.

CryptoMEV Bot NewsroomOct 26, 20264 min read

Four physical cryptocurrency coins representing Bitcoin and Ethereum on a plain white background. — Image: Stock Catalog / Wikimedia Commons (CC BY 2.0)

Key takeaways

Nine users lost about 9,408 SOL from 48 or 49 wallet addresses.
BloomTrading promised full reimbursement but published no payment schedule.
BloomTrading blamed a third-party RCE flaw, while Bitquery reported signer-key use.
Nearly all stolen SOL remained in one holding wallet during the investigation.

Nine users of the Telegram-based BloomTrading bot lost SOL after 49 wallet addresses were drained on October 26, 2026. BloomTrading said it would fully reimburse the affected wallets after attributing the incident to a remote code execution vulnerability in a third-party software module, according to Crypto.news.

Earlier, Crypto Briefing reported that approximately 48 to 49 wallets were targeted and that the attacker took about 9,408 SOL, then valued between $950,000 and $954,000. Some USDC holdings were reportedly left behind. BloomTrading temporarily disabled certain functions while investigating, but the precise functions affected and their restoration status were not independently confirmed.

Nine users await replacement funds

BloomTrading generated the private keys for wallets used with the platform and held them for transaction signing, according to Crypto Briefing. That custody arrangement made the mechanism significant: Bitquery reported that the attacker signed every transfer with the relevant wallet’s own key, without an approval prompt or contract interaction.

After the incident, BloomTrading said replacement funds would be sent to secure addresses designated by the nine affected users. The company rejected a community relief fund and said it would cover the losses itself.

"All affected users will be fully reimbursed by Bloom," — BloomTrading

The promise did not include a payment schedule, and BloomTrading had not confirmed that the refunds had been completed. AMB Crypto reported that the company was tracing the assets and considering options that might include freezing funds.

Wallet count and valuation differ

Bitquery traced 9,408 SOL worth about $953,000 taken from 48 wallets during a 94-second drain. Its investigation grouped those addresses under nine traders. The largest individual loss was reported elsewhere as 1,636 SOL, worth approximately $166,000.

CoinGabbar recorded BloomTrading’s later count of 49 addresses belonging to nine users and its stated loss of approximately 9,408 SOL, worth $947,000. The reporting resolved the discrepancy by identifying BloomTrading’s subsequent security update, which confirmed 49 affected wallet addresses, alongside Bitquery’s count of 48 traced wallets.

The initial Onchain Lens estimate was $954,000, and the final loss could be higher because that estimate covered transactions linked to one suspected receiving address. Bitquery found that nearly all 9,408 SOL remained in the attacker’s holding wallet, while about $56,853 in USDC was left behind. One owner moved $49,041 of the remaining USDC before the attacker returned for it.

Private-key findings differ

BloomTrading’s security update said no private keys had been accessed or compromised and that wallets outside the affected group remained safe. CoinGabbar listed unresolved questions about how funds moved if no keys were accessed, which third-party module was involved, and where the stolen SOL was located.

Bitquery’s on-chain account focused on how each transfer was signed. It reported that the wallet’s own signer approved each drain and that no contract or user approval was required. These accounts do not conflict on the central technical question: BloomTrading attributed the theft to remote code execution in an outside module, while Bitquery concluded that the transfers were authorized with private keys.

For readers comparing tools such as an Advanced Solana MEV Bot or a Profitable Sandwich Bot for Crypto Trading, this incident puts wallet-signing authority and custody directly into the technical review.

BloomTrading’s operating position changed

Before	After
Early reports described roughly 48 to 49 affected wallets and a haul valued between $950,000 and $954,000.	BloomTrading’s update counted 49 addresses belonging to nine users and valued the loss at approximately $947,000.
The initial response described a possible third-party compromise under investigation.	BloomTrading attributed the attack to remote code execution in a third-party software module.
Reimbursement was promised without a published payment schedule.	Replacement funds were set for secure wallets designated by affected users, but completion remained unconfirmed.

Readers following the incident should check:

Whether the full reimbursement has arrived at the newly designated address.
Whether the final loss total has changed.
Whether BloomTrading has identified the affected module and its provider.
Whether the traced SOL has been frozen or recovered.
Which bot functions have resumed.
Whether refund communications came through verified channels.

BloomTrading’s stated response was that no private keys were compromised, unaffected wallets remained safe, and every affected user would be fully reimbursed.