Bloom Trading Bot Suffers 9,408 SOL Hack, All Users Refunded Within Hours

Key Points

• On October 26, 48 wallets connected to the Bloom trading bot were drained of 9,408 SOL in a coordinated attack.
• Blockchain data shows each transaction bore only the victim’s own signature, with no co-signer present.
• Bloom maintains that private keys remained secure and attributed the breach to a vulnerability in an external module.
• Nearly half of the targeted wallets showed no trading activity for at least a month before the incident.
• The platform reimbursed all nine users in full by the end of the same day.

---

A coordinated exploit targeting the Bloom automated trading platform on Solana resulted in the theft of 9,408 SOL from 48 separate wallets. Blockchain analytics provider Bitquery traced the unauthorized withdrawals and published a detailed breakdown of the incident.

The entire operation unfolded in under two minutes, with all transfers occurring between 01:03:07 and 01:04:41 UTC on October 26. Every wallet was completely emptied during this narrow window.

According to Bitquery’s analysis, each withdrawal was executed as a standard SOL transfer bearing only the signature of the affected wallet itself. No additional authorization layers, token approvals, or secondary signers were detected in the transaction records.

Bloom responded the same day with a statement rejecting the possibility that private keys had been accessed. Instead, the company identified a remote-code-execution exploit within a third-party software component as the root cause.

The platform also assured users that wallets unaffected by the breach remain secure and operational.

http://twitter.com/BloomTrading/status/2114646392010359238

Understanding Bloom’s Security Features

Bloom’s support documentation instructs users to activate a withdrawal address lock for added protection. When enabled, this feature prevents any modification to the registered withdrawal address. Disabling the lock triggers a mandatory 24-hour waiting period before changes can be applied.

This mechanism is designed to prevent unauthorized parties who gain access to a user account from redirecting funds through the platform’s interface. It remains unknown whether the victims in this incident had enabled this security measure.

However, if an attacker obtains the actual private key, the withdrawal lock becomes irrelevant. With direct key access, funds can be transferred to any destination without altering the withdrawal address stored in the platform’s system.

Bloom’s website explains that its Extension, Manager, and Telegram interfaces all operate on a unified execution framework. A single wallet key maintains authority over assets regardless of which access point is being used.

Solana’s technical documentation distinguishes between local key storage and managed wallet services that handle signature requests. A legitimate owner signature could indicate either a compromised key or exploitation of the signing mechanism. Investigators have not yet determined which scenario occurred.

Inactive Accounts Among the Targets

[[LINK_START_0]]Bitquery’s research revealed[[LINK_END_0]] that 24 of the 48 compromised wallets had generated no Bloom trading fees during the 30 days preceding the attack. Five wallets last recorded fee payments between January and May 2025.

The analytics firm connected all 48 wallets to Bloom by examining historical fee payment records and organized them into nine distinct trader groups. Two of these groups were classified primarily based on the sequence in which their wallets were drained.

A comparable incident involving the TradeWiz bot illustrates how long security vulnerabilities can persist. Bitquery tracked that major exploitation event to September 30, documenting 20,793 wallets stripped of SOL, though no connection to the Bloom breach has been established.

In the TradeWiz case, two previously drained addresses received fresh deposits and were emptied again in less than four seconds.

As CryptoSlate’s coverage explains, users who suspect their keys may have been copied should immediately transfer assets to a newly generated wallet with a completely fresh key. Simply importing the compromised key into a different application maintains the same vulnerability.

At the time of publication, Solana’s SOL token was trading at $96.44, reflecting a 3.6% decline over the previous 24 hours.

Later on October 26, Bloom published an announcement confirming that all nine affected users had received complete reimbursement. The company stated that the compensation payments totaled 9,408 SOL and provided links to nine separate transactions as proof.