BloomTrading bot users lose nearly $1M as wallets get drained

Users of BloomTrading, a Telegram-based trading bot, report losing nearly $1 million after a wave of wallet drains on October 26, 2026.

The team has paused some services while it investigates. For traders who handed the bot the keys to their wallets, that pause offers little comfort.

Bloom says it is looking into a possible third-party compromise. It has also committed to reimburse affected users by sending funds to new, secure wallets.

What happened to Bloom users

Approximately 48 to 49 wallets tied to BloomTrading users were targeted in the incident. The attacker reportedly walked away with about 9,408 SOL.

At the time of the drain, that haul was valued between $950,000 and $954,000.

The losses were concentrated almost entirely in SOL. Some USDC holdings in the affected wallets were reportedly left untouched.

The individual damage was not evenly spread. Some affected traders, including well-known names in the space, cited personal losses reaching as high as $80,000.

Those users have pinned the blame on vulnerabilities in the Bloom service itself. Several urged others still using the bot to pull their funds out immediately.

Bloom’s response so far has three parts. It temporarily disabled certain functions, opened an investigation into a potential third-party compromise, and promised reimbursement through freshly generated, secure wallets.

How Bloom works, and why that matters

BloomTrading pitches itself as an advanced cross-chain trading automation tool. It runs inside Telegram and operates on Solana as well as EVM-compatible chains.

The company says it has been building software since 2018.

The key design choice is custody. Bloom generates the private keys for its users’ wallets, which means the platform, not the trader, is the one holding the master password.

Custodial trading bots have drawn criticism for precisely this structure. The risks include key exposure from server-side storage and compromised Telegram accounts.

Bloom’s own explanation, a possible third-party compromise, does not yet tell users which door was opened. Until the investigation concludes, that question remains the central one.

Not the first warning on custodial bots

The Bloom incident lands amid ongoing safety concerns around custodial trading bots more broadly. It has been noted alongside other security breaches in the crypto sector that underline the same weakness.

What this means for traders and trading bots

For Bloom’s users, the immediate question is execution on the reimbursement promise. A commitment to make people whole is meaningful only once the SOL actually lands in those new wallets.

The second question is the root cause. If the investigation points to a flaw in Bloom’s own infrastructure, the fix sits with the company. If it traces back to a third party or to user accounts, the lessons spread wider.

For now, the practical takeaway from affected users is blunt. Several have already told others to withdraw their funds, and until Bloom explains what went wrong, that advice is likely to keep circulating.

For a company that says it has been building since 2018, the next few updates may shape its reputation more than the previous several years combined.

Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.