BloomTrading Bot Users Lose Nearly $1M in Wallet Drains
BloomTrading said it is investigating a wallet-drain incident affecting users of its Telegram-based trading bot after reports surfaced that roughly $1 million in assets was taken from user wallets. The company acknowledged the incident in a post on its official X account and said affected users will be reimbursed.
There won't be any need for a relief fund. Bloom will fully reimburse all funds lost by the 9 affected wallets, directly to new, secure wallets designated by their respective owners.
We're still actively investigating the root cause, including whether a third-party provider may…
— Bloom (@BloomTrading) October 26, 2026
According to reporting cited by Crypto Briefing, about 9,408 SOL was removed from roughly 48 to 49 user wallets. The outlet said the tokens were worth about $950,000 to $954,000 at the time of the drain. BloomTrading also said it had paused some services while it reviews what happened.
What BloomTrading has said so far
The company said it is looking into a possible third-party compromise and has committed to reimbursing affected users by sending funds to new, secure wallets. It also clarified that the 49 affected wallets belonged to 9 individual users, rather than 49 separate victims.
Reports around the incident indicate that the drained wallets were associated with users who had imported private keys into the bot. That detail matters because simply disconnecting a bot may not be enough protection if a private key has already been exposed. BloomTrading has not publicly confirmed the full cause of the incident.
The incident appears to have affected SOL balances more than some other assets, with reports saying USDC remained untouched in several cases. The broader scope may still change as the company continues to review the wallets involved.
Security questions now center on key exposure
BloomTrading is a Telegram-based trading bot, which makes wallet access and key handling a central part of how users interact with the service. In incidents like this, the key question is not just whether a bot was disconnected, but whether wallet credentials were exposed in a way that let an attacker move funds directly.
For now, BloomTrading says it is still investigating the root cause and possible third-party involvement. The company has not yet provided a full technical explanation of how the drains occurred.
