Bloom trading bot review after third-party exploit and fund losses

Bloom trading bot review shows that the service experienced a targeted exploit on October 26, 2026, when attackers drained 9,408 SOL from 48 to 49 Solana wallets belonging to nine users. The transfers occurred in roughly 94 seconds through direct private-key signatures with no contract approvals involved. Bloom attributed the breach to a remote code execution flaw in a third-party module and stated that private keys themselves were not accessed.

The incident affected only SOL holdings; approximately $57,000 in USDC remained untouched or was moved by owners afterward. Half of the compromised wallets showed no recent trading activity, and five had been inactive since January through May 2025. Bloom paused all services immediately after detection and reported full reimbursement of the stolen SOL to the affected users on the same day.

Bloom trading bot security incident timeline and mechanics

The attack sequence began at 01:03:07 UTC and concluded by 01:04:41 UTC. A testing phase targeted one wallet per trader before the largest balances were drained in rapid succession. Bloom’s official statement ruled out broader wallet exposure and confirmed that unaffected accounts stayed secure. Public records on Solscan verified the refund transactions issued by the company.

The root cause remains tied to a third-party software module rather than Bloom’s core key-management system. Bloom described the vulnerability as complex and noted that no evidence pointed to direct key exfiltration. This distinction matters because many Telegram trading bots require persistent private-key access for automated execution, creating exposure windows even for dormant wallets.

Similar incidents have occurred with other Solana Telegram bots, including Banana Gun’s September 2024 loss of roughly $3 million. Bloom’s case stands out for the speed of both the drain and the subsequent full refund. As of November 1, 2026, services remain offline with no announced resumption date.

Refund process and user guidance after the Bloom exploit

Bloom committed to 100 percent reimbursement and completed transfers for all 9,408 SOL on October 26. The company also offered to negotiate partial recovery directly with the attacker and advised users to generate fresh wallets with new keys before any future reconnection. Stolen funds have not moved from the attacker address since the incident.

Users should monitor only official channels including @BloomTrading on X, bloombot.app, and the project Discord for restoration updates. Re-login attempts must use verified links to avoid phishing sites that commonly appear after publicized breaches. No additional losses beyond the initial nine users have been reported in available sources.

Practical steps for traders include generating new key pairs outside any bot environment, testing small amounts on restored services, and maintaining separate cold wallets for long-term holdings. The incident underscores the trade-off between automated trading speed and custody risk when private keys remain accessible to any third-party platform.

Comparison of recent Telegram trading bot incidents

Traders evaluating Bloom trading bot security after this event should weigh the company’s rapid refund response against the ongoing requirement for key custody in automated tools. Continued monitoring of official restoration announcements remains the immediate priority while services stay offline.