Bloom bot attacker drained 48 Solana wallets in 94 seconds, stealing $953,000, as Bloom pledges to repay all nine victims

An attacker drained 48 Solana wallets linked to Telegram trading bot Bloom in 94 seconds, moving 9,408 SOL worth about $953,000 from nine traders on October 26, according to blockchain analytics firm Bitquery.

Bloom has pledged to reimburse all nine and blames a third-party software flaw, but says user private keys were not compromised, even though Bitquery found the transfers were signed with those keys.

How the Bloom bot attack drained nearly $1 million

According to Bitquery’s on-chain investigation, the attacker emptied 48 wallets linked to the Bloom bot, transferring approximately $953,000 worth of SOL. The transactions were executed rapidly, with the funds moved out of the affected wallets within 94 seconds.

The analytics firm’s findings suggest that the operation was carefully coordinated rather than a series of unrelated thefts. The attacker reportedly tested wallets associated with individual traders before systematically draining their balances. The transaction sequence indicated that the attacker worked through the wallets in an organized pattern.

Bitquery also found that the transfers were signed using the private keys associated with the affected wallets. This detail is significant because a private key authorizes cryptocurrency transactions, allowing whoever controls it to move funds without requiring a separate approval from the wallet owner.

However, blockchain records alone do not establish how the attacker obtained access to those signing capabilities or identify the individual or group responsible.

The attack also appeared to target SOL specifically, leaving other assets in some affected wallets. Bitquery reported that approximately $57,000 in USDC remained across the wallets immediately after the initial drain, although some traders subsequently moved their remaining stablecoins to safety.

Bloom promises full reimbursement after security incident

In a statement posted on X on October 26, Bloom said it would fully reimburse the affected traders. The platform attributed the incident to a remote code execution vulnerability involving a third-party module and maintained that users’ private keys had not been accessed or compromised.

Remote code execution vulnerabilities can allow attackers to run unauthorized commands or code on a vulnerable system. Depending on the affected component and the privileges available to an attacker, such weaknesses can expose applications, connected services or sensitive operations to unauthorized activity.

Bloom’s explanation raises an important technical question: Bitquery’s investigation found that the stolen SOL transfers were signed with the affected wallets’ private keys, while Bloom said those keys had not been compromised. The available information does not conclusively reconcile these findings or establish precisely how the attacker executed the transfers.

A remote code execution flaw could potentially provide a route to unauthorized transaction signing without necessarily proving that private keys were extracted. Nevertheless, the exact mechanism remains unconfirmed, and further technical details would be needed to establish what happened.

Bloom’s reimbursement pledge offers a measure of relief to affected traders, but compensation does not eliminate the broader security concerns. The incident also highlights the importance of transparent incident reporting, independent security reviews and clear explanations of how customer funds are protected.

Dormant wallets raise questions about long-term security

One of the most concerning findings from the Bloom bot incident was that some affected wallets had not been used with the service for months.

Bitquery reported that five of the 48 drained wallets had not traded through Bloom since the first half of 2025. Their inclusion suggests that previously established wallet connections may remain a security concern even after trading activity stops.

Automated trading services allow users to buy and sell tokens quickly, often without manually approving every transaction. To provide this functionality, some bots manage wallets or hold access to the private keys required to sign transactions.

That convenience introduces additional risk. If a service or one of its connected components is compromised, wallets that remain accessible to the service could potentially be exposed even when their owners are no longer actively trading.

Crypto holders can reduce their exposure by moving substantial balances into wallets that do not share signing access with trading bots, limiting the funds kept in automated trading accounts and reviewing which services can access their assets. Anyone affected by a suspected compromise should also follow verified security instructions from the service and avoid sharing seed phrases or private keys with purported support representatives.

The attacker’s identity and the precise source of the vulnerability have not been established by the available evidence.

Previous Telegram bot exploits highlight wider risks

The Bloom bot incident is not the first major loss involving Telegram-based crypto trading services.

In September 2024, Banana Gun reported that users lost approximately $3 million in an incident involving its trading bot. The event raised concerns about the security of automated trading tools used by cryptocurrency traders seeking rapid access to newly launched tokens.

Earlier, in October 2023, security incidents involving Maestro and Unibot resulted in combined losses of approximately $1.1 million, according to blockchain security firm CertiK. Those incidents involved exploits affecting router contracts, illustrating that different parts of a trading bot’s technical infrastructure can create opportunities for attackers.

The incidents are not necessarily connected, and the methods involved differ. However, they demonstrate that automated trading platforms face multiple potential attack surfaces, including wallet management, software dependencies and smart contracts.

For the Bloom bot, the immediate priority is determining how the vulnerability was exploited, validating the reimbursement process and explaining what safeguards will prevent a recurrence. Traders will also be watching for confirmation that affected users have received their funds.

Bloom’s promise to cover the losses may help restore confidence, but the longer-term test will be whether the platform can demonstrate that its security controls, third-party dependencies and wallet-management practices are sufficiently robust. For traders across the wider crypto market, the incident is another reminder that transaction speed and convenience should never replace careful consideration of custody and security risks.