Bloom, a Telegram-based cryptocurrency trading bot, suffered a significant security incident on October 26, 2026, in which attackers drained approximately $953,000 in Solana (SOL) from 48 wallets in just 94 seconds. According to blockchain transaction analysis, the affected wallets belonged to nine traders.

Bloom has pledged to reimburse all affected users while it investigates the incident, including the possibility that a third-party service provider experienced a security breach.

Attackers Execute Rapid Solana Wallet Drain

Blockchain records show that the attackers transferred approximately 9,408 SOL from wallets associated with Bloom. The operation followed a coordinated pattern, suggesting the use of an automated script. The attackers first conducted small test transactions before targeting wallets with larger balances, then systematically emptied the accounts, completing the main operation within 94 seconds.

One wallet lost approximately 1,636 SOL, worth around $166,000 at the time, while six wallets accounted for roughly 61% of the total stolen cryptocurrency.

The attackers targeted SOL holdings while initially leaving approximately $56,853 in USDC untouched. One affected trader subsequently transferred about $49,000 in USDC to safety before another attempted withdrawal succeeded.

Bloom Promises Full Reimbursement

In response to the incident, Bloom committed to reimbursing the nine affected traders, saying it would transfer replacement funds to new wallets designated by their owners. The company also indicated that it was investigating a potential compromise involving a third-party provider, although the precise cause of the incident remains unconfirmed.

Bloom has maintained that its private keys were not compromised. Nevertheless, blockchain analysis identified transactions authorized using the affected wallets' private keys, raising questions about how the attackers obtained signing access. Investigators have not established whether the credentials originated from Bloom's infrastructure, an external provider, or another source. Pinning down where those credentials were exposed remains the central open question of the investigation.

Security Concerns Grow Around Crypto Trading Bots

The incident highlights the security risks associated with automated cryptocurrency trading services, which often maintain access to users' wallet credentials in order to execute transactions quickly. Telegram-based bots like Bloom let users buy and sell tokens through chat commands, and that convenience depends on the service being able to sign transactions on a user's behalf at any moment. The 94-second timeline illustrates the flip side of that speed: once signing access is abused, large-scale transfers can play out faster than detection or intervention.

Blockchain analysis also revealed that several affected wallets had remained inactive on Bloom since early 2025. This suggests that previously used trading wallets may remain vulnerable when their private keys are exposed.

As of the investigation's October 26 snapshot, approximately 9,408 SOL remained in an attacker-controlled wallet without further transfers. Whether those funds move, how Bloom's reimbursement process unfolds, and what the review of the third-party provider reveals are the key developments to watch as the investigation continues.

Bloom's reimbursement commitment could help affected traders recover their losses. However, the incident underscores the importance of protecting private keys and limiting funds stored in wallets connected to automated trading platforms.

Source: CryptoMeter io