Bloom Trading Bot Hacked: 9,408 SOL Drained in 94 Seconds — What the Wallet Exploit Means for Solana Traders

Event Analysis

On October 26, the Telegram-based automated trading bot Bloom suffered a significant security breach: approximately 9,408 SOL — worth roughly $947,000–$953,000 at the time — was drained from wallets belonging to nine traders across 48–49 affected wallets, according to Bloom's public statements and on-chain analysis by Bitquery. The entire sequence completed in roughly 94 seconds, with the attacker reportedly testing one wallet per trader before systematically emptying the rest in order of balance size.

The root cause remains technically disputed. Bloom attributed the incident to a remote-code-execution vulnerability in a third-party module and denied that private keys were copied. However, Bitquery's on-chain reconstruction found that all transfers were validly signed using each wallet's own private keys — consistent with a compromised signing environment rather than a simple front-end exploit. As reported by Yahoo Finance and corroborated by Bitquery's investigation, some drained wallets hadn't actively traded through Bloom since the first half of 2025, meaning dormant authorization persisted long after users had stopped using the service. Bloom has since announced full reimbursement of all nine affected users, limiting direct customer losses but leaving deeper structural questions unresolved.

What makes this incident particularly significant for the broader Solana ecosystem is not the dollar amount — 9,408 SOL is small relative to Solana's total market liquidity — but the operational security model it exposes. The attack fits squarely within the growing crypto wallet exploit and theft wave, where third-party integrations, retained wallet permissions, and shared signing infrastructure create systemic attack surfaces. For the AI agent and crypto trading automation space, this incident will sharpen scrutiny around how bots manage key custody, permission revocation, and dependency chains.

This breach also differs from typical exchange hot wallet hacks in a critical way: victims included users who had already stopped using the product, suggesting that wallet authorization does not automatically expire. This dormant-access vector is underappreciated and could affect many other Telegram and on-chain bot services operating on Solana and beyond, as detailed in our guide on hot wallet breaches and exchange hacks.

What This Means for Traders

The direct price impact on SOL is likely limited. According to live market data, SOL is trading at $97.38, down 2.26% on the day (24h range: $92.28–$97.81). The 9,408 SOL stolen is insufficient to materially move a token with Solana's liquidity depth, and full reimbursement by Bloom reduces forced selling pressure from victims. The more meaningful signal is sentiment: this event adds a fresh negative data point to a week that already includes a SkyAI treasury liquidation and broader Solana bot-ecosystem noise. Traders holding SOL leveraged positions should monitor whether the narrative compounds with additional security disclosures.

For crypto-linked equities, the incident is a weak indirect headwind. Coinbase (COIN) and Robinhood (HOOD) could see marginal sentiment drag if the story broadens into a wider bot-security narrative, though the connection is too tenuous to support a directional trade. The more actionable sector implication is for Solana-native DeFi and trading-bot infrastructure — increased user withdrawals from automated services and rotation toward centralized custody are plausible near-term responses. Traders interested in the broader pattern of crypto exchange hacks and their market fallout should treat this as a sentiment event rather than a liquidity shock.

Volatility on SOL perpetuals may tick up modestly if additional exploit disclosures emerge, but without that catalyst, this is unlikely to drive sustained directional movement. Monitor open interest on SOL perps for confirmation of any positioning shift, and check funding rates on CoinUnited.io before initiating leveraged positions.

Trade Solana on CoinUnited.io

Trade SOL with up to 2000x leverage → | Create Free Account

_Availability and maximum leverage depend on product, jurisdiction and account eligibility. Leverage amplifies losses and positions can be liquidated._