Breaches and incidentsBriefConfirmed by two or more outlets
Bloom Trading: Telegram trading bot wallets drained via a third-party module
26 Oct 2026. Bloom said about 9,408 SOL (about USD 947K) was taken from 49 wallets belonging to nine users.
- Disclosed
What happened
- 26 Oct 2026. Bloom said about 9,408 SOL (about USD 947K) was taken from 49 wallets belonging to nine users. Bitquery counted about USD 953K from 48 wallets in 94 seconds.
- Root cause per Bloom: “a remote code execution vulnerability in a third-party module”. Bloom says no private keys were compromised. Bitquery reports each drain was a SOL transfer signed with the affected wallet’s private key. The conflict is unresolved.
- Attribution: none.
- Response: Bloom shut down its systems and committed to full reimbursement to new wallets nominated by the owners.
Sources
- https://cointelegraph.com/news/bloom-bot-hackers-953k-faster-popcorn
- https://ambcrypto.com/bloom-trading-hit-by-947k-breach-due-to-third-party-module-promises-100-reimbursement/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.