Bloom Trading says a security flaw in third-party software led to the loss of 9,408 SOL from wallets linked to its crypto trading bot on Monday, October 26. The company put the damage at about $947,000 and identified nine affected users controlling 49 wallet addresses. It has promised to reimburse them in full.
A separate Solana transaction investigation by Bitquery traced a closely matching amount, valued at about $953,000 using the token price around the drain. The difference in dollar estimates reflects the valuation used, not a confirmed additional theft.
Bloom blames third-party code, says private keys were not leaked
In an October 26 incident statement, Bloom attributed the attack to a remote code execution vulnerability in a third-party module. Such a flaw can let an attacker run commands in a software environment that should be protected. The operator said private keys had not been accessed or leaked and that unaffected wallets were safe.
Those are the operator’s findings, not conclusions independently established by a public forensic audit. Bloom has not supplied enough technical detail in the material reviewed to show exactly how unauthorized transfers were signed, what system was exposed or whether any further remediation is required.
On-chain analysis traces a 94-second SOL drain
Bitquery identified 48 drained wallets across nine traders and said the main drain took 94 seconds, including a largest single-wallet loss of roughly 1,636 SOL. The platform’s separate count of 49 affected addresses may reflect different rules for counting tiny transfers or wallet activity; the two figures should not be treated as independently identical.
The analysis describes an initial collection address, 7kY8qx…p8BQ, followed by a transfer into 6nYyCz…moe9. Its reported snapshot showed roughly 9,408.21 SOL in that second wallet and no outgoing transfer from it through 07:34 UTC on October 26. That is a time-limited observation, not a claim about the wallet’s current balance.
The traced transfers were ordinary SOL movements signed by the sending wallets. This helps explain how the funds moved but cannot, by itself, prove how the attacker gained the ability to authorize them. A signed transaction is not the same thing as public proof that private keys were stolen or exported. That distinction matters because Bloom’s account and the on-chain observations answer different questions.
Old trading wallets were also affected
One notable finding concerns inactive wallets. Bitquery said 24 of the 48 addresses it traced had not paid a Bloom trading fee in the previous month. Five had last used the service in the first half of 2025. Their inclusion suggests that inactive hot wallets can still carry meaningful exposure when funds and transaction authority remain available.
The investigation also reported that the attacker primarily moved SOL rather than the USDC balances visible in the same wallets. In one case, an owner reportedly transferred roughly $49,000 in USDC away before a later attempt to reach it. These details are based on Bitquery’s reconstruction, not on statements from every affected trader.
Will Bloom users receive their money back?
Bloom says it will reimburse verified losses in full, using fresh wallets selected by affected users. It also paused services during its response and said it was tracing the stolen assets. A reimbursement promise is not proof that refunds have been paid. A completed payout schedule, independently confirmed reimbursement transactions and a published technical post-mortem remain important next steps.
Wallet owners who think they could be affected should check the operator’s verified support channels, keep transaction records and consider moving remaining assets to a new wallet with a freshly generated key. They should not share seed phrases with anyone claiming to offer refunds or recovery assistance. See BlockBriefing’s guide to hot and cold wallet security and its report on the recent Electrum wallet security fix for more on wallet risks.
What to watch next
- Whether Bloom publishes a detailed, independently reviewable incident report identifying the vulnerable component and remedial steps.
- Whether reimbursement transfers are verifiably completed for all nine users.
- Whether funds move from the on-chain holding address or investigators identify more affected wallets.
Reporting note: This story distinguishes Bloom’s own claims from independent transaction analysis. Numbers and wallet balances reflect dated source snapshots and may change as the investigation continues. This article is for news and educational purposes, not investment advice.
