Solana trading bot Bloom has reported a security incident in which an attacker drained approximately 9,408 SOL, worth around $947,000 according to the platform, from wallets belonging to nine users. The incident involved 49 wallet addresses, according to Bloom’s statement, and was attributed to a vulnerability in a third-party software module.
The attack occurred on October 26, 2026, triggering concerns among Solana traders who rely on automated trading tools to execute transactions quickly. Independent blockchain analysis by Bitquery traced 9,408 SOL from 48 affected wallets, with the funds moving in a series of rapid transactions over approximately 94 seconds.
Bloom said it had identified a remote code execution (RCE) vulnerability as the attack vector and pledged to reimburse all affected users. The company also said its investigation had found no evidence that private keys were compromised, although the precise technical mechanism behind the unauthorized transactions has not been independently established.
What Happened in the Bloom Trading Bot Exploit?
The incident affected users of Bloom, a cryptocurrency trading bot used by Solana traders to automate trades and manage multiple wallets.
According to Bloom’s security update, an attacker exploited a vulnerability in a third-party module to drain funds from wallets associated with nine users. The company said the incident affected 49 wallet addresses, while Bitquery’s on-chain investigation identified 48 wallets that lost SOL.
The difference in wallet counts has not been fully explained publicly. However, both reports point to the same overall scale of the incident: approximately 9,408 SOL was transferred without the affected users’ authorization.
The stolen cryptocurrency was valued at approximately $947,000 by Bloom. Bitquery’s analysis estimated the value at around $953,000 based on the SOL price during the transactions.
The incident highlights the security risks associated with automated cryptocurrency trading services, particularly when software components can interact with wallets and authorize transactions.
Third-Party Remote Code Execution Vulnerability Identified
Bloom attributed the incident to a remote code execution vulnerability in a third-party module.
Remote code execution is a security flaw that can allow an attacker to run code on a vulnerable system. Depending on the affected component and its permissions, this can potentially give an attacker access to sensitive functions or enable unauthorized actions.
Bloom has not publicly identified the third-party module or disclosed enough technical details to independently reproduce the attack. It is therefore unclear exactly how the vulnerability enabled the attacker to move funds from the affected wallets.
The company also stated that its investigation found no evidence that private keys had been compromised. That claim should be distinguished from the on-chain evidence: Bitquery’s analysis found that the affected wallets’ own signing keys authorized the transfers. This does not, by itself, establish how the attacker obtained the ability to produce those signatures.
Further technical disclosure would be needed to clarify how Bloom’s explanation of the third-party vulnerability relates to the transaction-level evidence.
On-Chain Analysis Traces 9,408 SOL in About 94 Seconds
Blockchain intelligence firm Bitquery investigated the transactions and reported that the attacker drained the affected wallets within approximately 94 seconds.
Its analysis identified 48 wallets associated with nine traders. The attacker appeared to conduct small test transfers before executing the larger withdrawals, with wallets emptied in a coordinated sequence.
Bitquery also reported that the attacker took SOL while leaving some USDC in the affected wallets. Its investigation traced almost all of the stolen SOL to a single wallet, where the funds remained unmoved at the time of its report.
These findings offer a clearer picture of how quickly the attack unfolded, but blockchain transaction records cannot independently identify the person or group controlling the receiving wallet.
The movement of cryptocurrency into a wallet also does not establish whether an exchange or law-enforcement agency has recovered or frozen the assets.
Bloom Promises Full Reimbursement to Affected Users
Bloom said it would fully reimburse the nine affected users for their losses.
The company stated that it would transfer replacement funds to new wallet addresses designated by the affected users. It also said there was no need for a community-funded relief effort because Bloom intended to cover the losses itself.
The reimbursement pledge is a significant part of the company’s response, but a public commitment to repay users is not the same as confirmation that the payments have been completed.
As of the reporting available for this article, Bloom had not publicly confirmed that every affected user had received full reimbursement. The company also had not disclosed a definitive timeline for completing all payments.
The platform said it was continuing to investigate the incident and pursue options for tracing and recovering the stolen cryptocurrency.
Why the Bloom Incident Raises Wallet Security Concerns
Automated trading bots can help cryptocurrency traders react quickly to market movements, but their convenience can involve security trade-offs.
Depending on how a bot operates, it may create wallets, import existing wallets or use signing credentials to execute trades automatically. If a service or one of its components is compromised, the consequences can extend beyond the trading interface itself.
The Bloom incident also demonstrates why stopping trades or ceasing to use a bot may not be enough to protect a wallet if its existing private key remains accessible to an attacker.
Users should consider the following precautions when using automated cryptocurrency trading services:
- Keep only limited funds in trading wallets. Avoid placing long-term holdings in wallets used for automated trading.
- Use a separate wallet for long-term assets. Keep savings in a wallet whose private keys have not been imported into third-party trading services.
- Review wallet permissions and credentials. Understand what access a trading bot requires and whether any exposed credentials need to be replaced.
- Follow official security updates. Use verified project channels to confirm incident details, recovery instructions and reimbursement procedures.
- Verify new wallet addresses carefully. Before transferring funds, confirm that the destination address is correct and controlled by the intended recipient.
These precautions cannot eliminate every security risk, but separating trading funds from long-term holdings can reduce potential losses if a trading service is compromised.
What Happens Next?
Bloom’s investigation now faces two major questions: how the third-party vulnerability enabled the unauthorized transfers and whether the stolen SOL can be recovered.
The company has pledged to reimburse affected users, but the completion of those payments remains an important milestone to monitor. Further technical disclosures could also help users understand the scope of the vulnerability and whether additional protective measures are necessary.
For the wider Solana ecosystem, the incident underscores the importance of reviewing the security of trading bots and other applications that interact with wallet credentials.
Until more technical evidence is released, the exact mechanism behind the exploit should be treated as Bloom’s reported explanation rather than an independently verified reconstruction of the attack.
Bottom Line
The Bloom trading bot exploit resulted in approximately 9,408 SOL being drained from wallets associated with nine users, representing a loss of nearly $1 million. Bloom blamed a remote code execution vulnerability in a third-party module and promised full reimbursement.
Independent on-chain analysis supports the reported scale and speed of the transfers, but important questions remain about the precise attack mechanism and the recovery of the stolen funds.
The incident serves as a reminder that automated trading tools can introduce wallet-security risks and that users should keep trading balances separate from long-term cryptocurrency holdings.
Disclaimer: This article is for informational purposes only and does not constitute investment, financial or cybersecurity advice. Cryptocurrency transactions are generally irreversible, and users should independently verify security information before taking action.
Also Check: Bitcoin and XRP Spot ETFs Attract Inflows as Ethereum and Solana Funds See Outflows
