The short version
- Bloom trading bot users lost 9,408 SOL, about $954,000, between 01:00 and 01:33 UTC on October 26, all sent to one drainer wallet.
- Every transfer was signed with wallet keys that Bloom keeps on its own servers, pointing to a breach on Bloom’s side or at a provider; Bloom says 9 wallets were hit and promises full repayment, while the chain shows 53.
- The crew is watching whether Bloom names the root cause and where the 9,408 SOL, moved on at 04:30 UTC, goes next.
Bloom trading bot users woke up to empty wallets on Monday. Between 01:00 and 01:33 UTC, 9,408 SOL, about $954,000, left dozens of wallets made with the Telegram bot and landed in one address. Three hours later the attacker moved the whole pile on in a single transfer.
Bloom says it is investigating, has switched off some services and will pay back every confirmed victim. It hasn’t said what broke. Here is what the chain shows so far, and what to do if you use the bot.
Bloom’s answer, three hours after the first user raised the alarm:
@Humanevolvd There won't be any need for a relief fund. Bloom will fully reimburse all funds lost by the 9 affected wallets, directly to new, secure wallets designated by their respective owners.
We're still actively investigating the root cause, including whether a third-party provider may
What Happened to Bloom Trading Bot Users?
Their wallets were emptied with their own keys, most likely through Bloom’s side and not through anything the users did. We checked the drainer wallet on Solana: 65 plain SOL transfers came in within 33 minutes, each signed with the private key of the wallet it left. On Bloom, those keys don’t sit with the user. Like most Telegram trading bots, Bloom creates or imports your wallet and keeps its keys on its own servers, so it can trade for you in a split second. Whoever signed these transfers got to those keys, through a hole in Bloom’s systems or in a provider it uses. Bloom hasn’t confirmed which.
53 wallets sent SOL into it, 41 of them more than 1 SOL each. The biggest single loss was 1,636 SOL, about $166,000. Two more wallets lost about 1,040 SOL and 1,022 SOL, roughly $105,000 each. On-chain tracker Onchain Lens, which flagged the drain at 04:26 UTC, counted 49 victims and warned that the final number “might be much higher.”
At 04:30 UTC the drainer sent all 9,408.2 SOL to a second fresh wallet. At the time of writing, the SOL is still sitting there.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
What Has Bloom Said About the Hack?
Bloom says nine wallets were hit and promises to repay them in full. At 03:02 UTC the team told the first victim it was investigating, that “all other wallets remain safe,” and that it was disabling some services as a precaution. At 04:37 UTC it said it would “fully reimburse all funds lost by the 9 affected wallets,” paid to new wallets, and that it was checking whether a third-party provider was the weak spot.
At 05:29 UTC it posted again: the root cause “has not yet been confirmed,” and it has “committed to fully reimbursing all confirmed affected users.”
The gap is the number. Bloom says nine wallets, while the chain shows 53 sending SOL to the same drainer. Some users run several Bloom wallets, so a person count and a wallet count can differ, but that is a question Bloom still has to answer.
The first alarm came from user @domyxbt at 01:28 UTC: about $80,000 gone, and the 640 SOL we traced from their “KOLSCAN” wallet, one of the wallets in their Bloom account, matches the drainer’s records.
DISCOVER: Your First Crypto Wallet, Set Up Safely: Hot vs Cold and the Seed Phrase
What Should Bloom Users Do Now?
Move what is left in any Bloom trading bot wallet, created there or imported, to a fresh wallet whose keys never touched the bot. Onchain Lens gives the same advice: disconnect and move funds. Affected users can open a ticket in Bloom’s Discord.
The bigger lesson of the Bloom hack is old: a bot that holds your keys is a hot wallet run by someone else. Keep only the money you trade with in it.
EXPLORE: The 10 Most Common Crypto Scams and How to Spot Them
This is a breaking story. The crew is watching whether Bloom names the root cause, whether its count of nine grows, and where the 9,408 SOL goes next.
On the climb since 2017. Trades futures and reads onchain data. Automates the boring parts.
More from VikingXBT →
