EL7.AI
CryptoMedium•26 October 2026•
4 min read

BloomTrading Theft Estimate Reaches $954,000 as Investigation Continues

Key Facts

1Crypto Briefing estimated the value of drained assets at between $950,000 and $954,000 at the time of the incident.
2The reported total was linked to 49 users on October 26, 2026, and the final amount could be higher.
3The largest reported individual loss was 1,636 SOL, worth about $166,000.
4Bloom temporarily disabled some services as a precaution and began an investigation.

Crypto Briefing estimated that assets drained from BloomTrading users were worth between $950,000 and $954,000 at the time of the incident, while TokenPost linked the reported total to 49 users on October 26, 2026. TokenPost said the final amount could be higher, making the available figures a reported total so far rather than a final estimate. Bloom has begun investigating the incident, according to TokenPost, but it is not yet clear whether it was caused by a third-party hack or another mechanism. Based on the available information, no direct official statement has settled the cause or confirmed compensation for those affected. The incident highlights the risks of using trading services that create users’ wallet keys and hold them on the platform.

Losses varied among users, with the largest reported individual loss reaching 1,636 SOL, worth about $166,000, according to TokenPost. That case forms part of the total linked to the 49 users, but highlights that the damage was not distributed evenly among them. Crypto Briefing’s overall estimate ranged from $950,000 to $954,000 at the time of the drain. The available information does not detail the balances of the other affected users or the amount of losses that may be added later. TokenPost said the final amount could be higher, without specifying when the total might be updated or providing a new figure.

Bloom took immediate operational action, temporarily disabling some services as a precaution while working to restore them, according to TokenPost. The report said the company had begun an investigation and quoted it as saying that "other wallets remain safe." The service disruption means users may face a temporary outage while the incident is reviewed, but the report did not identify the affected services or give a resumption schedule. The available information also offered no technical explanation of how the drain occurred or which systems are being examined. The announced response therefore remains limited to the investigation, precautionary suspension and assurance that other wallets are safe.

BloomTrading operates as a trading bot on Telegram, on the Solana network as well as EVM-compatible networks, according to Crypto Briefing. The report says Bloom generates users’ private wallet keys, meaning the platform holds the associated master keys. That arrangement makes key management central to the service’s operational risks, because users rely on the platform to create and protect their wallet keys. But the available information does not establish that key custody caused the current incident, or determine whether the drain resulted from a technical fault or unauthorized access. The cause remains under investigation, while Bloom said its other wallets are safe.

The incident follows EL7’s earlier coverage of a hack at the GoMining platform on September 5, 2026; the story’s headline said 600 wallets were targeted and losses were estimated at about $2.8 million. That places the BloomTrading incident among a series of security events affecting digital asset services and assets, with reported losses and the number of wallets or users varying in each case. In a broader context, TRM Labs said its investigation identified 224 victims of a fake trading-bot campaign between February and August 2026. The company added that 274.60 ETH, estimated at $517,205, was transferred to six collection addresses during that period. Those figures relate to a separate fake-bot campaign and do not establish a connection to the BloomTrading incident.

The next steps are to complete the investigation and restore the services Bloom disabled as a precaution, according to TokenPost, while the final tally of losses remains to be determined. The report said the reported figure could rise but gave no updated estimate or timeline. Crypto Briefing also said that compensation through new, secure wallets had been mentioned in coverage, but the available information contains no direct official confirmation of that promise from Bloom. Actual compensation reaching users therefore remains unconfirmed in the published reports. The cause of the drain, the scope of the damage and the platform’s plans for restoring services and providing compensation remain matters awaiting an update from the company.