Something in the signing chain of Bloom, an automated trading service built on Solana, failed on Monday, and the exact mechanism behind the incident remains unconfirmed.

On-chain records show that between 01:03 and 01:04 UTC on October 26, 48 wallets connected to the service sent a combined 9,408 SOL to an outside address — an average of 196 SOL per wallet. The outflows were completed within a window of roughly 94 seconds, the time span reflected in the incident's description as a 94-second signing breach.

Solana is a high-throughput blockchain, and its native token, SOL, is used to pay transaction fees and support network staking. Automated trading services built on the network execute trades by signing transactions with the private keys of the wallets under their control, which makes the integrity of the signing process central to the safety of the funds those wallets hold. That structure also shapes the scale of an incident like this: a single service can hold signing authority over dozens of wallets at once, and a network optimized for throughput can settle a large number of transfers in a very short time. The 94-second drain across 48 wallets reflects both properties.

In this case, on-chain data captured a rapid sequence of transfers that moved 9,408 SOL out of 48 connected wallets and to an external address within a single one-minute window. The timing places the transfers in the early minutes of Monday, October 26, 2026, UTC time.

The exact mechanism behind the signing failure has not been confirmed, and further details about the incident have not been made available. For now, the public record consists of the on-chain transfer pattern itself, and any fuller account of what went wrong would have to come from additional disclosure or further on-chain analysis.

This content was first published on COINOTAG: https://en.coinotag.com/bloom-solana-wallets-drained-9408-sol