On October 26, 2026, automated Telegram trading bot BloomTrading suffered a security breach that drained 9,408 Solana (SOL) worth nearly $954,000 from 49 wallets belonging to nine users. Bitquery reported the attacker executed the drain in 94 seconds. BloomTrading attributed the incident to a remote code execution vulnerability in a third-party software module while maintaining that private keys were not directly compromised. The platform took systems offline and pledged to reimburse 100% of the losses to new secure wallets.
Scale and speed of the exploit
- ▪Blockchain analytics company Bitquery reported that the October 26, 2026 BloomTrading exploit drained $953,000 across 94 seconds.
- ▪An attacker drained approximately 9,408 SOL worth between $947,000 and $954,000 from BloomTrading trading bot users
Vulnerability and private key controversy
- ▪BloomTrading attributed the October 26, 2026 security breach to a remote code execution vulnerability in a third-party software module.
- ▪Bitquery reported that each wallet drain during the October 26, 2026 BloomTrading incident was signed using the affected wallet's private key.
- ▪BloomTrading stated that no user private keys were compromised or accessed during the October 26, 2026 remote code execution exploit.
Impact on affected users and wallets
- ▪Trader Domy reported losing approximately 800 SOL across three wallets during the October 26, 2026 BloomTrading incident.
- ▪Bitquery reported that five wallets drained during the October 26, 2026 attack had been inactive on BloomTrading since the first half of 2025.
- ▪The October 26, 2026 BloomTrading security incident affected 48 to 49 wallet addresses belonging to nine individual users.
- ▪The single largest individual loss in the October 26, 2026 BloomTrading attack was 1,636 SOL, valued at approximately $166,000.
BloomTrading response and reimbursement
- ▪BloomTrading committed to fully reimbursing 100% of the stolen funds directly to newly generated, secure wallets designated by the nine affected users.
- ▪BloomTrading temporarily paused platform services, took all systems offline as a precautionary measure, and instructed affected users to submit Discord support tickets.
History of Telegram trading bot exploits
- ▪Telegram trading bots like BloomTrading manage or hold user private keys to execute automated trades, creating central attack vectors for server-side vulnerabilities.
- ▪In October 2023, users of Telegram trading bots Maestro and Unibot lost a combined $1.1 million to smart contract router exploits.
- ▪In September 2024, Telegram trading bot Banana Gun reported an exploit where 11 users lost approximately $3 million in Ether.
Onchain Lens findings
- ▪Blockchain tracker Onchain Lens noted that total losses from the BloomTrading exploit could ultimately exceed the initial $954,000 estimate.
- ▪Onchain Lens identified the primary receiving address for the stolen BloomTrading funds as 7kY8qx8MqJ7Rz2vMhgHETdZLHcTp1oM78AA9dmE9p8BQ.
Solana holdings and valuation
- ▪The reported loss figures from the October 26, 2026 BloomTrading exploit indicated an average price of approximately $101 per SOL during the drain.
- ▪The October 26, 2026 BloomTrading drain primarily targeted SOL holdings while leaving USD Coin (USDC) stablecoin balances untouched in affected wallets.
Story comments
Loading comments…