Solana Bot Bloom Drained of $947K in SOL, 9 Users Hit

Bloom, a Telegram-based trading bot supporting Solana and EVM networks, announced on 26 October 2026 that an attacker drained about 9,408 SOL, worth roughly $947,000, from 49 wallets belonging to nine users. The company has promised full reimbursement and paused some services while it investigates. SOL traded at $100.48, down 1.27% over 24 hours, with a $59.27B market cap and $2.51B in 24-hour volume as of 22:04 UTC today.

The theft is a breach of a single application, not an attack on the Solana network itself. Bloom says the attacker exploited a remote code execution vulnerability in a third-party module, meaning a flaw that allowed outside code to run inside part of the bot's software. Onchain Lens flagged the outflows to a single receiving address at 04:26 UTC, and early blockchain estimates put the loss slightly higher, at about $954,000.

The company's account and the independent tracing do not line up. Bloom says no private keys were compromised and that unaffected wallets are safe. Blockchain data firm Bitquery found that every transfer was validly signed by the source wallet's own key, and that the full sequence across 48 wallets took just 94 seconds. Bitquery could not establish how the attacker obtained that signing authority.

Some of the drained wallets had been inactive for months, and the order of the withdrawals suggests the targets were organised before the attack began. Until Bloom publishes a root cause, the claim that keys were not exposed should be read as the company's position rather than a confirmed finding. Bloom has not disclosed the terms of its reimbursement plan or a timeline for the root-cause report.

Context — Why the Bloom Drain Matters Now

The loss is small by Solana standards. In April, attackers took about $285 million from Drift Protocol, the network's largest perpetual futures exchange, in what TRM Labs called the biggest DeFi hack of 2026. That single event was roughly 300 times the size of the Bloom drain, which helps explain why SOL itself has not moved on the news.

What makes the incident consequential is timing. SOL has fallen about 14% in October, the weakest of the four largest cryptocurrencies, as spot Solana ETF outflows and a broad pullback from crypto risk weigh on sentiment. The token sits at $100.48 with 24-hour volume of $2.51B against a $59.27B market cap, a thin tape where a sub-$1 million exploit cannot register.

The more durable exposure sits in the Telegram trading bot segment. These applications ask users to surrender some control of transaction signing in exchange for execution speed, a trade-off that only holds while users trust the software layer holding that access. Bloom's own advice to move remaining funds to freshly generated wallets is an admission that the software layer failed, whatever the cause turns out to be.

If that trust weakens across the segment, memecoin and short-term trading activity could ease, and much of that activity runs on Solana. The catalyst chain is straightforward: a third-party module flaw, a 94-second automated drain, and a public disagreement between the operator and the chain's own record.

Data — What the Numbers Show

The scale is precise. Bloom says 9,408 SOL left 49 wallets held by nine users, a figure that values the haul at roughly $947,000. Onchain Lens put the first outflows to a single receiving address at 04:26 UTC. Early estimates ran slightly higher at about $954,000 before settling.

Bitquery's tracing differs on the wallet count, finding the drain across 48 wallets rather than 49. The same tracing established the timing: the entire sequence completed in 94 seconds. Bitquery also found every transfer carried a valid signature from the source wallet's own key.

Measure	Bloom's account	Bitquery's tracing
SOL drained	~9,408 SOL	Not disputed
Wallets hit	49	48
Users affected	9	Not stated
Duration	Not stated	94 seconds
Signing authority	Keys not compromised	Every transfer validly signed by source key

Against the market, the drain is noise. SOL's $947,000 loss equals roughly 0.038% of the token's $2.51B in 24-hour volume. The same sum is about 0.0016% of SOL's $59.27B market cap, which is why the tape shows a 1.27% daily decline rather than an incident-driven break.

Analysis — What It Means for Markets and Sectors

The first-order effect lands on Bloom's own users, and the company has committed to full reimbursement. The second-order effect lands on the Telegram bot segment as a category. Every bot that signs on a user's behalf inherits the same structural exposure: a weakness anywhere in the software path can move funds even when the underlying blockchain works exactly as designed.

Solana is the venue where that risk concentrates. Memecoin and short-term trading activity runs heavily on the network, and bots are the access layer for much of it. A confidence shock in that layer would not appear in SOL's price immediately, but it would show up in on-chain activity and in the fee revenue that activity generates.

The limitation in the current picture is that no root cause exists yet. Bloom attributes the breach to a third-party module and denies key exposure; Bitquery's finding that every transfer was validly signed by the source key sits uneasily beside that denial, but Bitquery could not establish how the signing authority was obtained. Both statements can be true if the attacker gained access to a signing path without extracting raw keys. Until Bloom explains the mechanism, neither account closes the question.

Positioning follows the tape. With SOL down about 14% in October on spot ETF outflows and a broad risk pullback, holders are already reducing exposure, and a contained application exploit gives them no reason to add. The flow that matters is out of speculative Solana activity, not out of the token on this headline.

Outlook — What to Watch Next

Bloom's root-cause report is the first catalyst, and the specific question is whether it explains how validly signed transfers were possible without key exposure. Confirmation that reimbursements have reached all nine users would ease concern; the company has not disclosed a timeline for either.

Evidence of wider key exposure would turn a contained incident into a broader question about bot security across the segment. Movement of funds from the receiving address is also worth monitoring, as a sign of whether recovery remains realistic. On the market side, SOL's October decline and the pace of spot Solana ETF flows are the variables that determine whether the token stabilises near $100.48 or extends the 14% monthly drawdown.

Frequently Asked Questions

What does the Bloom exploit mean for retail investors?

For anyone using a Telegram trading bot, the practical lesson is that signing access is a risk surface. Bloom has advised users to move remaining funds to new wallets with freshly generated keys. For investors holding SOL directly, the incident is contained to one application and represents a fraction of daily trading volume, so it does not change the token's fundamentals on its own.

What happens next for Bloom users?

Bloom has promised to reimburse every affected user in full and has paused some services during the investigation. The company has not disclosed the reimbursement terms or a completion date. Affected users hold nine wallets among them, spread across 49 addresses per Bloom's count and 48 per Bitquery's tracing, which is why the two accounts of the same event differ.