A bug in someone else’s code moved Bloom users’ SOL

Bloom Trading says an attacker never touched a single private key, yet still walked away with 9,408 SOL, worth roughly $947,000, from wallets the platform controls on behalf of its users. That distinction is the crux of the incident: Bloom is a custodial bot, meaning it generates and holds the private keys for every wallet it operates, according to CryptoBriefing. If the keys stayed secure, the attacker needed another way to authorize transfers out of those wallets, and Bloom has pointed to a remote code execution (RCE) vulnerability in a third-party software module as that route.

Bloom has not explained the specific mechanism that let a code-execution bug produce valid, signed transactions without key access, leaving a gap between its reassurance and the money that actually left user wallets.

Key Takeaways

  • Bloom Trading confirmed a breach on Oct. 26, 2026 drained about 9,408 SOL, worth roughly $947,000, according to the company’s own investigation.
  • Bloom attributed the theft to a remote code execution vulnerability in a third-party module and said no private keys were compromised.
  • Nine users controlling 49 wallet addresses were affected; Bloom pledged to reimburse 100% of the stolen funds to newly designated secure wallets.
  • Blockchain trackers flagged the largest single drain at 1,636 SOL (about $166,000), and some users reported losses as high as $80,000.

How the numbers moved as the picture came into focus

Early reporting treated the 49 drained wallets as 49 separate victims, but Bloom’s investigation later established that those addresses belonged to just nine users. Blockchain monitoring accounts caught the transfers in real time: Onchain Lens flagged the suspicious movement, and Onchain Alert reported that the attacker funneled the stolen SOL into a suspected drainer wallet, writing on X that “a hacker drained 9,408 SOL from 49 victims in one of its drainer [wallets], final number might be much higher.”

Dollar estimates shifted slightly depending on when they were calculated. Bloom’s own figure landed at approximately $947,000, while early on-chain parsing from blockchain trackers put the damage closer to $954,000, and CryptoBriefing cited a range between $950,000 and $954,000 at the time of the drain. Onchain Lens identified the largest single hit at 1,636 SOL, about $166,000, though the damage was uneven: CryptoBriefing reported that some affected traders, including well-known names, cited personal losses as high as $80,000.

The attacker’s targeting also had a pattern. Losses were concentrated almost entirely in SOL, with CryptoBriefing and Bitcoin.com News both reporting that USDC stablecoin balances in the same wallets were left untouched, a detail that suggests the exploit path interacted with SOL transfers specifically rather than draining every asset a wallet held.

Bloom’s response: shut it down, trace it, pay it back

Bloom took its entire platform offline as soon as the breach was confirmed. “All Bloom systems are currently offline as a precautionary security measure,” the team said on X, adding that once services are restored, users will need to log back into Bloom Manager and the Chrome extension to resume normal use. TokenPost reported the same shutdown, noting Bloom’s description of itself as a cross-chain trading automation platform built since 2018.

On the reimbursement question, Bloom has been direct: “Bloom will fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users.” The company says it is simultaneously tracing the stolen SOL and exploring freezing or recovery options, while advising affected customers to move any remaining assets into newly generated wallets. TokenPost’s separate report echoed the reimbursement pledge and the no-private-key-compromise claim, framing the incident as a test of user trust in the platform’s security practices rather than a dispute over the facts of the theft itself.

No outlet in this set reports a reimbursement deadline or a date for restoring service. Bloom has said only that an announcement will follow “once services are safely restored.”

What to Watch

The open question is the one Bloom hasn’t answered publicly: how a third-party RCE bug produced authorized-looking transfers without the platform’s private keys being exposed. Until Bloom details that mechanism, the incident sits as a live example of the risk CryptoBriefing flagged in custodial trading bots generally, where the platform, not the trader, holds the master keys. Watch for Bloom’s technical post-mortem, confirmation that the pledged reimbursements have actually reached the nine affected users’ new wallets, and any update on when the Telegram bot and Chrome extension come back online.

Sources