Solana Trading Bot Bloom Hacked for Nearly $1M as 49 Wallets Are Drained

October 27, 2026 MM Crypto Team

What Happened to Bloom Trading

Bloom Trading confirmed that an October 26 exploit drained 9,408 SOL worth approximately 947,000 dollars, in an incident that struck one of Solana’s best-known trading bots. Bloom is a popular tool among Solana traders, used to snipe new token launches, automate trades, and execute strategies faster than a human could manage through a wallet interface. The exploit affected nine users controlling 49 wallet addresses, a concentration that suggests the attacker targeted specific accounts rather than sweeping indiscriminately across the platform. Bloom identified a third-party RCE, or remote code execution, vulnerability as the cause, and said no private keys were compromised. That claim is central to the story, because it separates this incident from the more common pattern in which a bot’s key storage is breached and funds are drained directly. Bloom pledged full reimbursement to the nine affected users, and its statement was unambiguous on that point. The news comes amid a growing array of system bugs, data breaches and hacks across the crypto industry, and it lands at a moment when Solana trading bots are under particular scrutiny, because they sit at the intersection of speed, automation, and custody, holding the keys to users’ funds while operating in one of the fastest-moving markets in crypto. For the wider Solana ecosystem, the incident is a reminder that the tools traders rely on every day can become the weakest link in their security.

The Puzzle: No Private Keys Compromised, Yet Funds Moved

The most intriguing and troubling aspect of the Bloom incident is the apparent contradiction at its centre. Bloom said a third-party remote code execution vulnerability was responsible, and that no private keys were compromised. Remote code execution means an attacker found a way to run their own code inside a system they should not control, in this case a third-party component that Bloom relied on. If private keys remained secure, how did compromised third-party software gain authority to move nearly 1 million dollars? That is the technical question raised in coverage of the incident, and it deserves to be treated as an open question rather than a settled fact. There are several plausible explanations, and none of them has been confirmed publicly. One possibility is that the compromised component had been granted signing authority as part of its normal function, so the attacker did not need the raw private keys: they needed only to abuse the permissions the software already held. Many trading bots work this way, with a service holding delegated authority to sign transactions on a user’s behalf, and that delegation becomes a single point of failure if the service is compromised. Another possibility is that the remote code execution gave the attacker access to a live session or an in-memory process where keys were temporarily decrypted, allowing transactions to be signed without ever extracting the stored keys themselves. A third possibility is that the attacker manipulated the bot’s trading logic, tricking it into sending funds to addresses the attacker controlled as part of what looked like legitimate trading activity. Each of these scenarios carries a different lesson, and the distinction matters enormously for users trying to judge whether Bloom is safe to use again. If the problem was excessive delegated authority, the fix is to narrow those permissions. If it was a live-session compromise, the fix is to change how keys are handled in memory. If it was manipulated trading logic, the fix is to add checks on destinations and amounts. Until Bloom publishes a detailed technical account, users are left to guess, and that uncertainty is itself a cost, because trust in a trading bot is ultimately trust in its architecture, not just in its promises.

Full Reimbursement: What Bloom Promised

Bloom’s response on compensation was swift and unequivocal. The company pledged full reimbursement to the nine affected users controlling 49 wallet addresses, and its statement left little room for interpretation. Bloom said: “Bloom will fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users.” That is a strong commitment, and it stands in contrast to many crypto incidents where victims are offered partial recovery, tokens in a new project, or nothing at all. A 100 percent reimbursement pledge signals that Bloom has the reserves or the revenue to absorb a loss of nearly a million dollars, and that it values its reputation enough to pay it. Bloom has not publicly established a reimbursement deadline or announced when normal operations will resume, so affected users know they will be paid but not when, and they do not know when they can safely trade through the bot again. The reimbursement is to be paid directly to secure wallets designated by the affected users, which is the right approach, because sending funds back to the same compromised wallets would be reckless. Affected customers were advised to transfer remaining assets into newly generated wallets, a standard precaution after any incident where the integrity of a wallet’s environment is in doubt. Users who lost funds need certainty, not just reassurance, and the crypto industry has seen too many reimbursement pledges that faded into silence. Bloom’s track record and its explicit 100 percent commitment give it credibility, but credibility is only confirmed when the payments actually arrive.

Tracing, Freezing, and the Hunt for the Attacker

Bloom is tracing the stolen cryptocurrency, exploring freezing and recovery options, and attempting to identify the attacker, a three-part effort that is standard after a major theft but rarely straightforward. Tracing 9,408 SOL on Solana is technically feasible, because every movement is recorded on a public ledger, and blockchain analytics firms can follow the funds as they move between wallets, exchanges, and decentralised protocols. The difficulty lies in what happens next. If the attacker moves quickly to a centralised exchange, there is a chance the funds can be frozen, but only if the exchange cooperates and the funds arrive before they are withdrawn or swapped. If the attacker uses decentralised exchanges, mixers, or cross-chain bridges, freezing becomes far harder, and the trail can go cold. Exploring freezing and recovery options suggests Bloom is pursuing both the on-chain and the legal routes, potentially working with exchanges and law enforcement to flag the attacker’s addresses. Attempting to identify the attacker is the longest shot of all, because skilled attackers use fresh wallets, virtual private networks, and other operational security measures to hide their identity, and many crypto thefts are never attributed to a named individual. For the affected users, the tracing effort matters less than the reimbursement pledge, because they have been promised full repayment regardless of whether the stolen funds are recovered. For the industry, however, the outcome of the tracing effort matters a great deal, because a successful recovery would show that even fast-moving Solana thefts can be clawed back, while a failure would reinforce the sense that stolen crypto is gone for good once it leaves the victim’s wallet.

What This Means for Solana Trading Bots

The Bloom incident is a warning for the entire Solana trading bot ecosystem, which has grown rapidly as Solana’s trading volumes have surged. Trading bots are attractive because they are fast: they can buy a new token within seconds of its launch, execute complex strategies around the clock, and react to market moves that a human would miss. That speed comes with a trade-off, because a bot that can move funds quickly on your behalf is also a bot that can move funds quickly to an attacker if it is compromised. Users grant these tools significant trust, often connecting wallets that hold substantial balances, and many do so without fully understanding the permissions they are granting or the third-party components the bot depends on. Bloom’s statement emphasised that the team has developed software since 2018 and operated in cryptocurrency markets since 2021, a reminder that experience does not guarantee immunity. Longevity can even breed complacency, because a system that has worked for years without incident can accumulate dependencies and permissions that nobody has reviewed recently. The third-party angle is especially important: modern software is built from dozens of libraries and services, and a vulnerability in any one of them can compromise the whole. That is why security teams now audit not just their own code but their entire supply chain, and why the most careful users spread their funds across multiple wallets, keeping only what they need for active trading in a bot-connected wallet. The practical lessons are clear: use fresh wallets for bot trading, limit the balances exposed to any single tool, revoke permissions you no longer need, and treat any tool with signing authority as a potential single point of failure. The Bloom hack does not mean trading bots are unusable, but it does mean they should be used with eyes open, and with the understanding that convenience and security are always in tension.

FAQ

How much was stolen in the Bloom Trading hack? Bloom confirmed an October 26 exploit drained 9,408 SOL worth approximately $947,000 from nine users controlling 49 wallet addresses.

Were private keys compromised in the Bloom hack? Bloom said no private keys were compromised and blamed a third-party remote code execution vulnerability, though how the attacker moved funds without the keys remains an open question.

Will Bloom reimburse the victims? Yes, Bloom pledged full reimbursement, saying it will fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users.

What should affected users do now? Affected customers were advised to transfer remaining assets into newly generated wallets, and to wait for Bloom’s reimbursement to secure wallets they designate.

When will Bloom resume normal operations? Bloom has not publicly established a reimbursement deadline or announced when normal operations will resume, so users are waiting for a timeline.

Source: Bitcoin.com

MM Crypto Analysis Web