Bloom Trading Bot Key Compromise Drains $953,000 in SOL Across 48 Wallets

An attacker drained 9,408 $SOL—worth approximately $953,000—from 48 wallets associated with the Telegram-based trading bot Bloom early on Oct. 26 ¹. According to an investigation by Bitquery, the compromise impacted nine high-volume traders, with an automated script systematically emptying the affected accounts over a span of 94 seconds ¹. At the time of writing, $SOL was trading down 1.6% over 24 hours at $99.70.

Blockchain data indicates the transfers relied directly on the wallets' underlying private keys, executing plain SOL transfers without interacting with smart contracts or exploiting malicious token approvals ¹. The incident mirrors broader risks flagged in past security incidents, such as when Swell Network hot keys were compromised, highlighting the systemic vulnerabilities inherent to custodial key architectures ¹. The automated script conducted initial trial runs on a single wallet per trader before draining their remaining balances in descending order of size, leaving behind stablecoins like $USDC and memecoins while targeting native SOL exclusively ¹. Notably, 24 of the 48 depleted wallets had not executed a trade through Bloom within the preceding month, including five accounts inactive since the first half of 2025 ¹.

Exposure and Planned Restitution

The exploit underscores custodial trade-offs associated with Telegram-native algorithmic trading tools, which typically store user private keys on internet-connected infrastructure to execute automated low-latency transactions on Solana ¹. Bitquery observed that the entirety of the stolen 9,408.21 SOL was consolidated into a single address (7kY8qx…p8BQ) and has remained untouched ¹. Following the exploit, Bloom issued an official statement pledging to fully reimburse all losses incurred by the nine affected account holders ¹.