Cross-chain trading automation tool Bloom Trading users’ wallets drained of about $950,000 in bulk
Users of the cross-chain trading automation tool Bloom Trading reported that assets in their wallets had been stolen. According to monitoring by Onchain Lens, the suspected drain address has received 9,408 SOL (about $954,000), involving 49 wallets, with the largest single transfer being 1,636 SOL (about $166,000); the final figure may be higher. The relevant report advised users to disconnect immediately and transfer their funds to a new wallet.
The official Bloom Trading account said the team is investigating the issue, and the root cause has not yet been confirmed, including the possibility of a third-party compromise. The official said it has identified 9 affected users (the 49 wallets belong to these 9 users), and other wallets remain safe. Out of caution, some services have been temporarily disabled, and the company promised full reimbursement for verified affected funds, while also recommending moving the remaining funds to a new wallet with entirely new private keys.
The tool is a Telegram trading bot that supports Solana and EVM chains. Its official website says its cumulative trading volume exceeds $4.5 billion and it has more than 70,000 active traders. After the incident, some users reported that only SOL had been transferred, while some USDC was not touched.
Original sources:
Title: BLOOMTRADING USERS REPORT WALLET DRAINS, $954K MOVED TO SUSPECTED DRAINER Publisher: Onchain Lens (@OnchainLens) Publication date: 2026-10-26 URL: https://x.com/OnchainLens/status/2114574282282160371 Source nature: firsthand post Verification: the original post was actually read for this report, verification date 2026-10-25 Supporting content: supports the monitoring figures of 9,408 SOL, 49 victims, about $954,000, the largest single transfer of 1,636 SOL, and the advice to disconnect and transfer funds
Title: We've identified 9 affected users so far... Bloom has committed to fully reimbursing all affected funds. Publisher: Bloom (@BloomTrading) Publication date: 2026-10-26 URL: https://x.com/BloomTrading/status/2114579401157329148 Source nature: firsthand post Verification: the original post was actually read for this report, verification date 2026-10-25 Supporting content: supports that the official account has identified 9 affected users, is investigating, and has committed to full reimbursement
Title: We're actively investigating the full scope and root cause... 49 affected wallets belong to 9 individual users Publisher: Bloom (@BloomTrading) Publication date: 2026-10-26 URL: https://x.com/BloomTrading/status/2114599403059122649 Source nature: firsthand post Verification: the original post was actually read for this report, verification date 2026-10-25 Supporting content: supports that the root cause has not been confirmed (including possible third-party involvement), that 49 wallets belong to 9 users, the recommendation to move to a new-wallet with new private keys, and the commitment to reimburse verified losses
Title: BloomTrading bot users lose nearly $1M as wallets get drained Publisher: CryptoBriefing Publication date: 2026-10-26 URL: https://cryptobriefing.com/bloomtrading-bot-users-wallet-drains/ Source nature: media report Verification: the full article was actually read for this report, verification date 2026-10-25 Supporting content: supports that about 9,408 SOL were stolen from about 48-49 wallets, about $950,000-$954,000, that the official investigation may involve a third-party compromise and that some services were paused, with reimbursement promised
ABAB AI Insight
Bloom Trading is a Telegram trading bot and cross-chain automation tool launched in October 2024, focusing on fast execution, copy trading, and automated strategies on Solana and EVM chains. Its official website says cumulative trading volume exceeds $4.5 billion and active traders exceed 70,000. Such tools are typically based on wallets whose private keys are generated and held by the platform so that trades can be executed automatically in the background, rather than by users fully self-custodying their assets.
In this incident, funds moved from multiple Bloom-related wallets to a suspected drainer address, and the official investigation includes the possibility of a third-party compromise, with a promise of full reimbursement for verified losses. Unlike purely non-custodial wallets, once users hand their private keys to the platform, any compromise of the platform’s key management, servers, or related accounts can expose bulk-transfer risk all at once. The figures from Onchain Lens and several media outlets consistently point to about 9,408 SOL, but the official clarification says there were 9 users rather than 49 separate victims, indicating that early monitoring may have counted multiple wallets belonging to the same user separately.
As with similar Telegram trading bot incidents in the past, once the platform holds the private keys, simply disconnecting cannot revoke access to already exposed keys; users need to move funds to a new wallet with brand-new private keys to cut off the risk. Bloom has explicitly promised reimbursement this time and extended the investigation to third parties, unlike some tools that only cite user error or refuse responsibility. One thing to watch is whether the official account later discloses the root cause, whether reimbursed funds actually arrive in the new wallets as promised, and whether the private-key custody model is changed.
ABAB News · Laws of cognition
For a trading bot that custody private keys on its platform, once a side-channel key is exposed, the risk can expand from a single user to a bulk wallet drain.
Disconnecting cannot revoke access to an already exposed private key; transferring funds to a new wallet is the way to cut off the path.
When an official reimbursement promise and a root-cause investigation proceed at the same time, actual receipt and public disclosure determine the degree of trust recovery that follows.