Bloom Bot Hack: 9,408 SOL in 94 Seconds and What to Learn

In the Bloom bot hack of October 26, 2026, an attacker emptied 48 wallets belonging to nine users in 94 seconds and took 9,408 SOL, about $947,000. Bloom refunded every affected user in full the same day, and we checked the refund transactions on-chain ourselves. Below: what happened, what Bloom said, and five habits that limit what a drain like this can take from you, whatever bot you use.

Quick summary

• On October 26, 2026, 9,408 SOL (about $947,000) left the wallets of 9 Bloom users in 94 seconds: 48 wallets in Bitquery's on-chain count, 49 in Bloom's.
• Bloom blamed a remote code execution flaw in a third-party module and said no private keys were accessed.
• Bloom refunded all 9,408 SOL the same day. We checked the transfers on Solana: all nine users were paid.
• Half of the drained wallets had not traded on Bloom for a month, and five had been idle since the first half of 2025. Money left in a bot wallet stays at risk.

What happened in the Bloom bot hack

Bitquery, an on-chain analytics firm, rebuilt the attack from the blockchain the same day. All times are UTC on October 26, 2026.

Every drain was a plain SOL transfer signed with the wallet's own key: no token approval, no smart contract, no second signer. The script emptied the wallets user by user, largest balance first, and took only SOL, leaving about $56,853 in USDC behind.

One owner even saved 48,550 USDC: the attacker's first attempt to move it failed because that wallet had no SOL for the network fee, and the owner got the money out 96 seconds after the attacker sent 0.02 SOL to cover the fee.

What Bloom said

• Cause: "The attack exploited a third-party module through a complex Remote Code Execution (RCE) vulnerability." Bloom has not named the module.
• Keys: "No private keys were accessed or compromised", and wallets outside the affected group were safe.
• Scope: 49 wallet addresses belonging to 9 users, about 9,408 SOL ($947,000).
• Shutdown: all Bloom systems went offline as a precaution. When they return, every user has to log in again to Bloom Manager and the Chrome Extension.
• The attacker: Bloom said it had collected IP addresses and the data centers used, and offered to negotiate a partial return of the funds in exchange for not taking legal action.

One point is still open. Bitquery found that every drain was signed with the wallet's own key and says the chain can't show how the attacker got that power. Bloom says the keys themselves were not accessed. Neither has published the full technical path, so we won't guess at it here.

Was the refund paid?

Yes. At 20:37 UTC on October 26, Bloom posted: "We confirm that 100% of the affected funds, totaling 9,408 SOL, have been fully refunded to all 9 users", with a Solscan link for each of the nine refund transactions.

We checked them on-chain. All nine went through on October 26, sent from the address Bloom had published as its contact for the attacker. Each user first received a 1 SOL test transfer, then the rest: 9,408.23 SOL in total, less than 20 hours after the drain.

5 lessons for any trading bot user

1. Idle money in a bot wallet is still at risk

Half of the drained wallets (24 of 48) had paid no Bloom fee in the 30 days before the attack. Five had last traded through Bloom between January and May 2025. Their owners had moved on, but the wallets still held SOL and the bot still held their keys. When you stop using a bot, empty its wallets. Don't park money there "for later".

2. Keep only trading money in the bot

The attacker picked large wallets: six of them held 61% of what was taken, and the median wallet lost about $9,000. Size a bot wallet for the trades you plan to make this week. Keep savings in a wallet whose key has never touched a bot, ideally a hardware wallet. More everyday habits are in our 10 rules to keep your wallet safe.

3. Withdraw on a schedule, not when something goes wrong

Nobody reacts in 94 seconds. At that moment, the only safe money is money that has already left. Withdraw profits to your own wallet on a fixed rhythm, for example every week and after every big win. Before you send, check the whole address, not just the first and last characters: minutes after Bloom's first test refunds, look-alike addresses (same first and last characters as the real ones) started sending tiny transfers to Bloom's refund wallet, hoping someone would later copy the wrong one from the history. That trick is called address poisoning.

4. In-app settings don't protect the key

A withdrawal address lock or a PIN guards the bot's own buttons. It can't stop a transfer signed with the key itself, and that is what every drain here was. Spreading money over several wallets in the same bot doesn't help either: one user here had 12 wallets, and the script emptied all of them. What limits the damage is how much sits in the bot at all, and keeping the key of your main wallet out of every bot.

5. Check a bot's security record before you deposit

On our copy trading bots page, open a bot's details: the Security score and "Latest updates" show confirmed hacks, how much was lost and whether users were paid back, with the source. You can also type "hack" in the search box. Bloom's note now reads "Hacked for $947K, fully refunded". We score Security 9 out of 10 for a clean record, 7 for a hack that was fully refunded, 6 when a refund was promised but not confirmed, and 3 when users got nothing back.

FAQ

Is Bloom safe to use after the hack?
No trading bot is risk-free, Bloom included. Bloom says the flaw was in a third-party module and no private keys were accessed, and it repaid every affected user within a day. Whether that is enough is your call. Either way, keep only trading money in the bot wallet. Our Bloom guide covers its features and safety settings.

Did Bloom refund the stolen SOL?
Yes. Bloom refunded 9,408 SOL to all nine affected users on October 26, 2026 and linked every transaction on Solscan. We checked them on-chain.

Is Bloom back online?
Bloom took all systems offline on October 26 and said users would have to log in again to Bloom Manager and the Chrome Extension. We found no restart post on @BloomTrading, but its changelog lists updates on October 29 and November 2, and DefiLlama has recorded Bloom trading volume every day since. Log in only through bloombot.app, never through a "log in again" link someone sends you.

I used Bloom months ago. Should I do anything?
Yes, and the same goes for any bot you have stopped using. Open your old bot wallets, and if any still hold funds, move them to a wallet whose key has never been used with a bot. Half of the wallets drained here had not traded on Bloom for a month.

Key takeaway

The Bloom bot hack was fast and narrow: 94 seconds, nine users, at least 650 SOL taken from each. Bloom paid everyone back within a day. The part you control is the same with every bot: how much sits in the bot wallet, how often you withdraw, and whether old wallets still hold money.

Before you pick a bot or top one up, compare security records, fees and copy trading for 20+ bots on our copy trading bots page.

Trade Fast. Trade Smart.

Sources: Bloom's posts on X (statement, refunds), Bitquery's on-chain investigation and our own check of the nine refund transactions on Solana. Nothing here is financial advice.