$953,000 Stolen From 48 Wallets Linked to Bloom Bot in 94 Seconds
Key Facts
A total of 9,408.23 SOL, worth an estimated $953,000, was withdrawn from 48 wallets linked to the Bloom trading bot in 94 seconds on October 26, according to tracking data cited by TokenPost from Bitquery. Bloom said it would fully reimburse the affected users, while the cause of the incident remained undetermined. The speed and concentration of the transfers over a short period show the scale of the funds that left the wallets. Bitquery tracked transfers from 48 wallets, while Bloom said 49 wallet addresses belonging to nine users were affected. Bitquery’s tracking counted the 48 wallets as belonging to nine traders, explaining the difference in the number of addresses between the two accounts.
The transfers began at 01:03:07 UTC and ended at 01:04:41 on October 26, according to the times reported by TokenPost. The report estimated SOL’s value at about $101.30 during the transfers, the price used to estimate the funds withdrawn. The largest single withdrawal was 1,636 SOL, or about $166,000. Six wallets accounted for 61% of the total SOL withdrawn. The figures show that a large share of the funds left through a limited group of wallets during the rapid operation.
On-chain transactions showed that each transfer was a standard SOL transaction signed with the sending wallet’s key, according to analysis cited by TokenPost. The transactions did not include a token approval, smart contract or additional signer. Bloom said it had found no evidence that private keys were compromised, but the transaction record shows the transfers passed the wallets’ authorization rules. On-chain data does not establish how the attacker obtained signing access. Bloom said it was investigating whether “an external service provider was compromised,” while Bitquery’s analysis indicated that malware on traders’ devices or leaked keys they had exported themselves could produce the same outcome.
The transfers affected wallets that were not all recently active on Bloom: Bitquery said 24 of the 48 wallets had not traded through the bot during the previous month. Five wallets had not traded through Bloom since the first half of 2025, yet were included in the withdrawals. The operation left $56,853 in USDC in the wallets when the SOL was withdrawn, according to Bitquery. From one wallet, the attacker later tried to withdraw $49,041 in USDC, but its owner moved the funds before the attacker could reach them. The owner’s transfer came 96 seconds after the SOL reached a network-fee wallet, in a brief race for the remaining balance.
Bloom said it would cover the losses in full and send the funds to new wallets chosen by their owners, according to its response on X about three and a half hours after the withdrawals. It added that a community relief fund was unnecessary because the company would handle reimbursement itself. Bloom did not specify when the payments would be completed, while the cause of the incident remained under investigation. Bitquery said trading on Bloom stopped after the incident, and the last trading fee it detected was at 04:05 UTC on October 26. It detected no further fees three and a half hours later.
In Bitquery’s latest check, announced at 07:34 UTC on October 26, the second custody wallet held 9,408.21 SOL and had not sent any funds. Bitquery had not detected either of the attacker’s wallets reaching an exchange, bridge or mixing service by the time of the check. It said the second wallet had sent nothing at its latest review, but the on-chain record does not establish the identity of the person controlling it. The Bloom incident follows earlier trading-bot breaches, including the draining of more than 20,000 wallets at TradeWiz in late September and about 2,400 Ethereum wallets in the LootBot incident during September. The reimbursement announcement cited by Bitquery did not give a specific date for transferring the funds to the new wallets.