Bloom Trading, a Telegram-native trading bot that automates trades across Solana and EVM-compatible chains, said on October 26 that it is investigating a wave of wallet drains that moved roughly 9,408 SOL — about $954,000 — out of user accounts. The team paused some services as a precaution and committed to fully reimbursing the nine wallets it has confirmed were affected, while blockchain investigators traced the outflows to a single suspected drainer address. The incident is the latest reminder that a trading bot that holds its users’ keys is only as secure as the infrastructure that guards those keys.
Our team is currently investigating the issue. All other wallets remain safe.
Out of an abundance of caution, we’re temporarily disabling some services, and we’re working to restore them as soon as possible.
To stay in direct contact with our team, please open a ticket on…
— Bloom (@BloomTrading) October 26, 2026
What happened on October 26
Blockchain-monitoring account Onchain Lens was among the first to flag the activity. In a post on X, it said a “hacker drained 9,408 $SOL from 49 victims” into one drainer wallet and warned the “final number might be much higher.” The largest single transfer was 1,636 SOL, worth about $166,000 at the time of the drain.
Bloom later clarified that the 49 wallets belong to nine users, which means several traders had multiple wallets swept in the same incident. That distinction changes the math. The reported $954,000 haul implies a Solana price of roughly $101.40 at the moment of the drain — 9,408 multiplied by that figure lands within a rounding error of Onchain Lens’s estimate. Spread across nine affected users, the average loss works out to about $106,000 each, though the damage was not even: the largest individual wallet lost roughly 1,636 SOL, or about $166,000, while some traders reported losing around $80,000.
A custodial design at the center
What separates Bloom from a self-custody wallet is where the private keys live. Bloom generates and stores the keys for the wallets it operates, so the platform — not the trader — holds the master credentials. That is the point of failure in this kind of setup. When a Telegram bot handles signing, the security boundary is not the user’s device or seed phrase but the bot’s backend: its key storage, its servers, and any third-party service wired into them.
Bloom describes itself as a cross-chain trading automation tool and says on its website that it has processed more than $4.5 billion in cumulative volume and serves more than 70,000 active traders. Those are the numbers of a platform where key custody is concentrated, and where a single compromise can fan out across many accounts at once — which is exactly the pattern Onchain Lens observed, with 49 wallets drained to one address in a single wave.
The distinction from non-custodial bots matters for how users should think about exposure. Some Telegram trading tools never hold the seed and only receive a public key or a delegated signing scope, so a backend compromise cannot move funds on its own. A custodial design like Bloom’s collapses that separation: whoever controls the backend’s key store can sign transactions for every wallet it manages. That is not a criticism unique to Bloom — it is the same trust model as a centralized exchange — but it means the practical recovery story depends entirely on the operator’s treasury and willingness to make users whole, which is precisely the promise Bloom has now made.
Why only Solana moved
One detail stands out in the reports: the drain appears selective. Several affected users said only SOL was transferred while USDC balances sitting in the same wallets were left untouched. Bloom has not confirmed a reason, and the root cause is still unproven, so any explanation is preliminary. But the asymmetry is consistent with a drainer script that targeted a specific token balance rather than sweeping everything, or with an attacker working against a liquidity or slippage constraint on a single asset. It is a useful reminder that “custodial” risk is not binary — an attacker with partial access may still move only part of a wallet’s value.
Bloom’s response: investigation and full reimbursement
Bloom’s commitment to make users whole came in direct terms. Replying to a user who suggested a relief fund, the team wrote: “There won’t be any need for a relief fund. Bloom will fully reimburse all funds lost by the 9 affected wallets, directly to new, secure wallets designated by their respective owners.”
On the investigation itself, Bloom has been careful not to overstate what it knows. “Our team is currently investigating the issue. All other wallets remain safe,” the team posted, adding that “out of an abundance of caution, we’re temporarily disabling some services, and we’re working to restore them as soon as possible.” It also said it is still working to determine whether a third-party provider was involved, without naming a suspect or a specific compromise. Until the investigation closes, the exact entry point remains an open question, and Bloom has not given a date for when reimbursements or full service will return.
The wider Telegram-bot security picture
Telegram trading bots now hold a meaningful share of retail on-chain volume, and their custodial model concentrates the same risk that centralized exchanges have spent years learning to manage — key custody, withdrawal controls, and third-party integrations. The Bloom drain is not the first weak-seed or backend incident this month, and it is unlikely to be the last. For anyone running capital through a bot, the practical checklist is short: treat the bot as a custodian, keep only what you are willing to expose, and understand how keys are generated and stored before trusting a platform with signing power. We have covered the mechanics and risks of these tools at length, including how to weigh custodial versus non-custodial trading bots.
For a fuller breakdown of how these platforms work and where the risks sit, see our guide to Telegram trading bots , and for the broader question of whether to hand over signing power at all, read how to choose a trading bot .
Frequently Asked Questions
Roughly 9,408 SOL, worth about $954,000, was moved to a suspected drainer address across 49 wallets belonging to nine users. The largest single transfer was 1,636 SOL, about $166,000.
Yes. Bloom said it will fully reimburse all funds lost by the nine affected wallets, sent directly to new, secure wallets designated by their owners.
Bloom says all other wallets remain safe, but it has temporarily disabled some services while it investigates a possible third-party compromise. The root cause has not yet been confirmed.
This article is not intended as financial advice. Educational purposes only.
