Skip to content

Loss · Oct 26, 2026 · Trading bot

Bloom Telegram trading bot wallets drained of 9,408 SOL

Amount
$953K
9,408 SOL; Cointelegraph reported $953K, investingLive about $947K, early on-chain estimates about $954K
Affected
Bloom Trading
Chains
Solana
Status
Confirmed by the affected party or a post-mortem
Returned or recovered: All nine affected users refunded in full the same day, according to Bloom.

What happened

Bitquery reported that 48 Bloom-linked wallets belonging to nine traders were drained of about 9,408 SOL in 94 seconds on 26 October 2026, with each transfer signed by the wallet's own key. Bloom said the cause was a remote code execution vulnerability in a third-party module and that no private keys were accessed. Cointelegraph reported five of the wallets had been inactive on the bot since the first half of 2025. CryptoSlate and Parameter reported Bloom said it refunded all nine users in full the same day.

Why it happened

  • Supply chain

    A malicious or compromised dependency, plugin, MCP server, model router or third-party module.

    Ask of your own agent: Which vendor, plugin or router sits between your agent and its key?

Free checks for this pattern, in your browser:

Sources

  1. Bloom Bot Hackers Loot $953K Faster than You Can Microwave PopcornCointelegraph · news · Oct 27, 2026 · I checked the page: it names this incident Nov 8, 2026
  2. Solana trading bot Bloom drained of $947,000 in SOL as nine users' wallets emptiedinvestingLive · news · Oct 26, 2026 · I checked the page: it names this incident Nov 8, 2026
  3. Hackers drain 9,400 SOL from bot wallets, and a copied key is blamedCryptoSlate · news · Oct 30, 2026 · I checked the page: it names this incident Nov 8, 2026
  4. Bloom Trading Bot Suffers 9,408 SOL Hack, All Users Refunded Within HoursParameter · news · Oct 30, 2026 · I checked the page: it names this incident Nov 8, 2026

Added Nov 8, 2026, last updated Nov 8, 2026. I wrote this from the sources above; nothing here goes beyond what they report. Involved in this incident, or see an error? Send a correction or a reply; replies from affected parties are added to the entry, dated.

Could the same thing happen to your agent?

Send me one real agent workflow. In my free 48-hour integration review I go through it end to end against this incident's pattern (supply chain) and send you a written report: where the same path exists, what would stop it, and the tests that prove it.

Request the free 48-hour review

This is a record of public reports, not a security audit, legal, compliance or investment advice. Names appear only as the sources report them.