--- title: "Bloom Trading Bot Key Compromise Drains $953,000 in SOL Across 48 Wallets" description: "An automated script took 9,408 SOL across nine users in 94 seconds using direct private key access, prompting a refund pledge from the Telegram bot." url: https://basisdesk.news/news/bloom-trading-bot-solana-drain-investigation published: 2026-10-27T09:36:25.829Z modified: 2026-10-27T09:36:25.829Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: bearish tickers: [SOL, USDC] tags: [bloom, solana, exploits, trading-bots, telegram, custody] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Bloom Trading Bot Key Compromise Drains $953,000 in SOL Across 48 Wallets An automated script took 9,408 SOL across nine users in 94 seconds using direct private key access, prompting a refund pledge from the Telegram bot. ## At a glance - **What happened:** An attacker used stolen private keys to drain 9,408 SOL ($953,000) from 48 wallets tied to the Bloom Telegram trading bot on Oct. 26 [1]. - **Why it matters:** The compromise exposes critical custodial vulnerabilities in low-latency Telegram trading bots that store user private keys on internet-connected servers [1]. - **Who is affected:** Nine high-volume traders using the Bloom trading bot whose wallets were targeted in the drain [1]. - **What's next:** Bloom executing promised reimbursements for all lost funds to the nine affected wallet owners [1]. - **Primary source:** [Bloom Trading Bot Hack: $953K in SOL From 48 Wallets](https://bitquery.io/investigations/bloom-trading-bot-hack) — bitquery.io ## Key points - An attacker stole 9,408 SOL ($953,000) from 48 wallets used with the Telegram trading bot Bloom on Oct. 26 [1]. - Bitquery reported that the script used native private keys directly to drain nine traders' wallets in descending order over 94 seconds [1]. - Bloom announced on X that it will fully reimburse all funds lost by the nine affected users [1]. ## Editorial remark - **Context:** Telegram trading bots retain user private keys on internet-connected hot servers to provide rapid trade execution for on-chain memecoin swaps, exposing users if backend databases or credentials are breached [1]. - **Impact:** Nine traders incurred combined losses of $953,000 in native SOL across 48 wallets, while associated stablecoin balances and memecoins were largely left intact [1]. - **Watch:** Market participants are monitoring the attacker's holding wallet for fund dispersion and tracking Bloom's reimbursement payouts to the nine impacted traders [1]. An attacker drained 9,408 $SOL—worth approximately $953,000—from 48 wallets associated with the Telegram-based trading bot Bloom early on Oct. 26 [1]. According to an investigation by Bitquery, the compromise impacted nine high-volume traders, with an automated script systematically emptying the affected accounts over a span of 94 seconds [1]. At the time of writing, $SOL was trading down 1.6% over 24 hours at $99.70. Blockchain data indicates the transfers relied directly on the wallets' underlying private keys, executing plain SOL transfers without interacting with smart contracts or exploiting malicious token approvals [1]. The incident mirrors broader risks flagged in past security incidents, such as when [Swell Network hot keys were compromised](https://basisdesk.news/news/swell-network-hot-key-compromise-oracle-manipulation), highlighting the systemic vulnerabilities inherent to custodial key architectures [1]. The automated script conducted initial trial runs on a single wallet per trader before draining their remaining balances in descending order of size, leaving behind stablecoins like $USDC and memecoins while targeting native SOL exclusively [1]. Notably, 24 of the 48 depleted wallets had not executed a trade through Bloom within the preceding month, including five accounts inactive since the first half of 2025 [1]. ## Exposure and Planned Restitution The exploit underscores custodial trade-offs associated with Telegram-native algorithmic trading tools, which typically store user private keys on internet-connected infrastructure to execute automated low-latency transactions on Solana [1]. Bitquery observed that the entirety of the stolen 9,408.21 SOL was consolidated into a single address (7kY8qx…p8BQ) and has remained untouched [1]. Following the exploit, Bloom issued an official statement pledging to fully reimburse all losses incurred by the nine affected account holders [1]. ## FAQ **How did the attacker drain the Bloom wallets?** According to Bitquery, the drain transactions were direct SOL transfers signed by each wallet's private key rather than through smart contracts or token approval exploits [1]. **Will affected Bloom users receive compensation?** Bloom posted an announcement stating it will fully reimburse all funds lost by the nine affected wallets [1]. ## Sources 1. [Bloom Trading Bot Hack: $953K in SOL From 48 Wallets](https://bitquery.io/investigations/bloom-trading-bot-hack) — bitquery.io, 2026-10-26 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai