Bloom trading bot users lost about 9,408 SOL in minutes. What Telegram bots do with your wallet keys

An attacker emptied dozens of Solana wallets belonging to users of Bloom, an automated trading service people use through Telegram. The company says it will repay everyone affected. Whatever caused it, the incident shows something every bot user should understand: a bot that trades for you holds the key to your wallet.

What happened

In the early hours of Monday, October 26, 2026 (UTC), SOL began leaving wallets that had been used with Bloom. Affected traders started posting about their losses on X within minutes, and blockchain-monitoring accounts such as Onchain Lens flagged the transfers a few hours later.

Bloom posted a series of updates on X that day. In its most detailed statement, posted at 09:12 UTC, it said:

• 49 wallet addresses belonging to 9 users were affected. An earlier Bloom post stressed that this meant 9 people, not 49 separate victims.
• Total losses were approximately 9,408 SOL, which it valued at about $947,000.
• The root cause was a third-party module exploited through a remote code execution (RCE) vulnerability, a flaw that lets an attacker run their own code on someone else's system.
• "No private keys were accessed or compromised," and unaffected wallets are safe.
• Bloom will repay 100% of the stolen funds into secure wallets each affected user designates, and it is trying to trace the funds and identify the attacker.

Some accounts on X suggested an "exit scam," where a project's operators run off with users' money. In a post that day, Bloom said its team has been building software since 2018 and "would never compromise our integrity for any amount of money." Cointelegraph, The Crypto Times and Bitcoin.com News all reported Bloom's account and its refund pledge.

What the blockchain shows

Bitquery, a blockchain data company, traced every transfer and published its findings the same day. Its numbers differ slightly from Bloom's: it counted 48 drained wallets and put the loss at about $953,000. Among its other findings:

• After one small test transfer per trader, the script emptied the wallets one trader at a time, mostly going from the biggest balance to the smallest. Bitquery says 94 seconds passed between the first wallet being emptied and the last.
• Each drain was a simple SOL transfer carrying only the wallet's own signature, with no token approval, smart contract or co-signer. Bitquery concludes that whoever sent them held the private keys.
• The attacker took only SOL. Owners moved most of the roughly $57,000 in USDC left behind to safety afterward.
• Five of the drained wallets had last been used with Bloom in the first half of 2025.
• The stolen SOL sat in attacker-controlled wallets and hadn't touched an exchange, bridge or mixer when Bitquery published.

Bitquery also says it found no on-chain link between the attacker's wallets and Bloom's fee wallet, and that the record alone can't prove who the attacker is. Bloom's statement that no private keys were compromised and Bitquery's finding that each drain carried the wallet's own signature haven't been publicly reconciled. The full technical cause isn't public yet.

Why trading bots are hot wallets

A normal self-custody wallet asks you to approve every transaction. Trading bots skip that step so they can buy a new coin the moment it launches. To do it, the bot either creates a wallet for you or imports one you already have, and then signs trades on its own servers.

That means the bot keeps a working copy of your private key, the secret that authorizes every transaction. Put simply, any wallet a bot controls is a hot wallet, and its key lives on someone else's internet-connected computer. If that key leaks, through the bot, a provider it relies on, or malware on your own device, anyone holding it can move your coins, and the blockchain treats the transfer as if you sent it.

Telegram trading bot users have been hit before, though not always through leaked keys. Cointelegraph noted that Banana Gun users lost about $3 million in September 2024, and that Maestro and Unibot users lost a combined $1.1 million in October 2023 through exploits of the bots' router contracts.

What this means for you

• Most beginners never need a trading bot. They are built for fast, high-risk memecoin trading. Buying and holding through a reputable exchange or your own wallet doesn't involve one.
• If you do use one, keep it lean. Treat the bot wallet like cash in your pocket: only what you're actively trading. Keep savings in a wallet whose key only you hold, ideally a hardware wallet.
• Clean up old bot wallets. Some Bloom wallets that were drained hadn't been used on the bot for over a year. A key stays exposed until the coins move to a wallet with a new key.
• Watch for follow-on scams. After hacks, fake "refund portals," "recovery agents" and support accounts appear quickly. Use only a company's official channels, and never share a seed phrase or private key to "claim" anything.

New to wallets? Our guide to how crypto wallets work explains hot, cold and exchange wallets, and our wallet drainer guide covers the other ways coins get stolen.

The takeaway

Bloom says a flaw in a third-party module let an attacker drain about 9,408 SOL from 9 users, and it promises full refunds. Bitquery's on-chain analysis shows the attacker could sign as the wallet owners. However the keys were reached, the lesson is the same: speed tools that trade for you hold your keys, so keep only small, active amounts in them. This is education, not financial advice, and it reflects Bloom's statements and Bitquery's analysis as of October 27, 2026.

Published October 27, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.

About the author

Dave McNaught

Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.

Full bio