Bloom bot hack: 9,408 SOL drained from 48 wallets with owner-key signatures, Bitquery says

30 Oct 2026

30 Oct 2026, 23:11 UTC+01:00

Altcoins TradeReviewed News Desk

The Bloom bot hack drained 9,408 SOL from 48 wallets linked to the automated Solana trading service, and a new on-chain reconstruction suggests every transfer was signed by the wallets’ own keys. Data firm Bitquery found the drains ran in under two minutes, from 01:03:07 to 01:04:41 UTC on October 26, 2026, according to a CryptoSlate report published on October 30.

What Bitquery found

Each drain was a plain SOL transfer signed only by the affected wallet’s key, with no second signer and no token approval involved. Bitquery tied the 48 wallets to Bloom through past fee payments and grouped them into nine traders. Half of the wallets, 24 of 48, had paid no Bloom trading fee in the month before the attack, and five last paid one between January and May 2025. In other words, old and inactive bot wallets were still exposed.

Bloom denied on October 26 that private keys were accessed. It blamed a remote-code-execution vulnerability in a third-party module, said unaffected wallets were safe, and later that day said all nine affected users had been fully refunded, a total of 9,408 SOL. Which signing path the attacker actually used remains unresolved.

Why a withdrawal lock was not enough

Bloom offers a withdrawal address lock with a 24-hour cooldown to stop attackers from redirecting withdrawals inside the bot. That protects the service’s own withdrawal flow, but it cannot stop a fresh transfer signed elsewhere by anyone holding the wallet key. CryptoSlate also points to the separate TradeWiz drain on September 30, where Bitquery counted 20,793 wallets drained of SOL and saw two emptied addresses receive new deposits that were swept again within four seconds. No shared cause between the two incidents has been established.

What it means for traders

• If you used any Telegram or browser trading bot, assume its wallet key could be exposed. Move leftover funds to a fresh wallet with a new key and never send funds back to the old address.
• Changing passwords or interfaces does not revoke a copied private key. Only moving assets to a new key does.
• Prefer regulated venues with clear security records for active trading. See our crypto exchange comparison, the BingX review (number 1), the OKX review (number 2), how we test exchanges, and where to buy your first Bitcoin.

This is not financial advice.

Sources

• CryptoSlate: Hackers drain 9,400 SOL from bot wallets, and a copied key is blamed

Follow TradeReviewed on X and our Telegram channel: you hear crypto and trading news here first.

Related reviews

• Bingx review
• Okx review

Sources

• CryptoSlate: Hackers drain 9,400 SOL from bot wallets, and a copied key is blamed

News is for information only and is not financial advice. More crypto news