Bloom users lose 9,408 SOL in 94-second wallet drain; bot pledges full refunds

Hackers drained about 9,408 SOL, worth roughly $950,000 at the time, from wallets belonging to nine users of Bloom, a Telegram trading bot for Solana and other chains, on the morning of Oct. 26 KST. Bloom said in a statement on its official X account that evening that it "will fully reimburse 100% of the stolen funds."

Bloom said the attack exploited a remote code execution (RCE) vulnerability in a third-party module and that no users' private keys were accessed or compromised. Blockchain analytics firm Bitquery, however, said in an investigation report that every outgoing transfer was signed with the wallet owner's own private key, leaving the two sides at odds over how the attack occurred.

48 wallets emptied in 94 seconds

According to Bitquery's report, the attacker sent a 0.01 SOL test from the largest wallet to a new address at around 10 a.m. KST on Oct. 26. Less than two minutes later, one additional small test transfer was made from wallets belonging to each of the nine victims, a few seconds apart. The full drain began at 10:03:07 a.m. and ended at 10:04:41 a.m. In those 94 seconds, 48 wallets were emptied one after another, and the largest single drain was 1,636 SOL.

The hardest-hit of the nine users lost 1,864 SOL (about $189,000) across five wallets. The median loss per wallet was about 89 SOL (about $9,000). Of roughly $56,853 in USDC left in the wallets, owners moved about $52,035 to safety first. The stolen SOL was consolidated into a single holding wallet (6nYyCz…moe9) at around 1:30 p.m., and no funds had left that wallet as of 4:34 p.m., Bitquery's last check.

'Keys safe' versus 'signed with owners' keys'

The two also differ on the wallet count, with Bloom citing 49 and Bitquery 48. Bitquery said that for two of the nine users, the drain order was the main evidence for grouping the wallets. Bloom said it had "identified the exact attack vector" but did not name the provider of the module.

Wallets idle for months were hit too

Bitquery said 24 of the 48 drained wallets had paid no Bloom trading fee in the 30 days before the attack, and five had not traded through Bloom since the first half of 2025. Wallets that had not been used recently were emptied along with active ones.

Bloom is a trading toolkit made up of a Telegram bot, a web dashboard and a browser extension that works inside other trading terminals. According to its website, it supports Solana, BNB Chain, Base and Ethereum, among others, and offers features such as copy trading, which mirrors other traders' moves, and orders across multiple wallets at once. "Our team has been developing software since 2018 and operating in crypto since 2021," Bloom said in the statement, adding that its commitment to business continuity remains unchanged.

SOL trades at 133,500 won on Upbit

Around 10 a.m. KST on Oct. 26, when the drain took place, SOL traded around $101 on Binance. As of 8:30 p.m. KST on Oct. 27, it traded at $100.13 on Binance, 133,500 won on Upbit's Korean won market and 133,600 won on Bithumb. The Upbit price was about 0.6% above the Binance price converted to won, a so-called kimchi premium (the gap between prices on Korean exchanges and global markets). The incident occurred in Bloom users' wallets and was not an outage of the Solana network itself.