Bloom Trading, a Telegram-native trading bot that automates trades on Solana and EVM-compatible chains, said on October 26, 2026 that it is investigating a wave of wallet drains that moved roughly 9,408 SOL, worth about $954,000, out of user accounts.
Blockchain monitoring account Onchain Lens was among the first to flag the activity, reporting that a hacker drained 9,408 SOL from 49 victims into one suspected drainer wallet. Bloom later clarified that the 49 wallets belong to nine users, meaning several traders had multiple wallets swept in the same incident. The largest single transfer was 1,636 SOL, about $166,000, while some traders reported personal losses of around $80,000. The attacker appears to have targeted only SOL: several affected users said USDC balances in the same wallets were left untouched.
Bloom has paused some services as a precaution and promised full reimbursement. The team wrote: 'Bloom will fully reimburse all funds lost by the 9 affected wallets, directly to new, secure wallets designated by their respective owners.' It is still investigating whether a third-party provider was compromised and has not identified a root cause or given a date for restored services.
The incident highlights custody risk in Telegram trading bots. Bloom generates and stores private keys for user wallets, meaning the platform, not the trader, holds the master credentials. That concentrates risk in the bot's backend, key storage, servers and third-party integrations. Bloom says it has processed more than $4.5 billion in cumulative volume and serves more than 70,000 active traders.
Market data showed Solana trading at Rp1,824,689 on Indonesian platform Pluang as of October 26, down 1.35% over the past day.
