48 Bloom wallets lost 9,408 SOL in 94 seconds. All of them belonged to nine traders
A Telegram trading bot's users found their SOL gone before most of Europe was awake. We followed every transfer to learn whose wallets they were, how the attacker picked them and where the money is now.
- 9,408 SOL
- 9 traders
- 1 signer
- 24
- $56,853
- 0 SOL
01 · What happenedWhat happened to Bloom trading bot users
If you trade memecoins through a Telegram bot, the bot can spend from your wallet. Early on Monday, someone else did. In 94 seconds, 48 wallets lost almost all of their SOL, worth close to a million dollars.
The owners noticed fast. Eight minutes after the drain, one trader posted a $64,000 transfer out of his wallet and asked for help. Within half an hour, another account was calling it a possible exit scam, the kind where a project runs off with its users' money. "got drained for 100k gg," a third trader wrote later, under a link to his own transfer.
Every one of the 48 wallets had been used with Bloom, a trading bot that runs inside the Telegram chat app. You tap a button or type a command, and Bloom buys or sells a coin for you in seconds. To trade that fast, Bloom keeps the private key to each wallet you use with it. A private key is the secret code that approves transactions, and whoever holds it can move everything inside.
Bitquery traced every transfer in the drain with its Solana data. In all, the attacker took 9,408 SOL, about $953,000. The 48 wallets belong to nine traders. The attacker tested one wallet for each of them, then emptied their wallets one trader at a time, biggest first. The list included wallets that had not traded on Bloom for more than a year. The attacker took only SOL and left behind about $57,000 in USDC, a dollar stablecoin. Almost every SOL taken still sits in one wallet, untouched.
02 · How the bot holds your keysHow a Telegram trading bot holds your keys
Trading bots like Bloom either create a fresh wallet for you or import one you already have. After that, the bot signs your trades on its own servers. There is no pop-up to approve, which is why memecoin traders use these bots to get into new coins first.
The price of that speed is that the bot holds a live copy of your key. In crypto terms, every bot wallet is a hot wallet, one whose key sits on a machine connected to the internet. If those keys leak, anyone holding them can empty the wallets, and the blockchain treats it as the owner moving their own money.
Bloom charges a fee on each trade, paid in SOL to a single fee wallet. That is how we know who used Bloom. In the month before the drain, more than 6,000 wallets paid it.
03 · 94 secondsOne test per trader, then 94 seconds
The attack began just before 1am UTC with two failed tries on the biggest wallet in the set. Then the attacker sent a small test from that wallet to a brand-new address, 7kY8qx…p8BQ, which would collect everything that followed. It was the first SOL that address had ever received.
Less than two minutes later came nine more tiny tests, a few seconds apart. Each came from a different trader. Soon after, the first wallet was emptied in full. Then the main run started, and the script emptied 47 more wallets in 51 seconds.
The order gives the plan away. For each trader, the script started with the wallet it had tested, then went down their wallets from the biggest balance to the smallest. Eight of the nine runs follow that order exactly. The attacker's list was sorted by trader before the drain began.
04 · Nine tradersNine traders, not 48 strangers
Bloom's own count is nine. In a post on X, it promised to "fully reimburse all funds lost by the 9 affected wallets." The chain shows 48 wallets that lost SOL. Five clues tie them to nine people.
The first two are the tests and the running order. The third is Bloom's own fees. When a trader buys from several wallets at once, those wallets pay their fees in the same second. Dozens of pairs among the 48 did this again and again, and every such pair sat inside a single trader's group.
The fourth came after the drain. Trader 1 sent what was left in all five of their wallets to one new address, and trader 8 did the same with most of theirs. The fifth is a screenshot of trader 6's Bloom wallet list, which we were shown. It lists six wallets. Five were drained within a few seconds of each other, and the sixth has never made a transaction, so there was nothing in it to take.
Both public posts fit. The "100k" post matches trader 4, who used one wallet, and the $64,000 transfer came from trader 6's biggest.
These were whales. The smallest loss by any trader was 650 SOL. The median wallet lost about $9,000, and six wallets held most of the SOL taken.
05 · One scriptOne script, and the owners' own keys
Every drain was a plain SOL transfer, signed by the wallet's own key and nothing else. There was no token approval for a user to be tricked into, no smart contract and no second signer. Whoever sent these transactions held the private keys.
They also came from one script. Each paid exactly the same network fee, including a small tip to get in faster. Each left behind the same tiny amount of SOL, enough to keep the account open. The first full drain left a little less, and a try seconds before it had failed because it left too little. The attacker was still tuning the script as it ran.
The keys may have been stolen at different times. They were used together, by one person or group, in one sitting.
06 · Old walletsEvery wallet had used Bloom, some not for a year
All 48 had paid a Bloom fee at least once. One paid a single fee, back in March. Half had not traded on Bloom in the month before the drain, and five had not since the first half of 2025.
The old wallets matter because they point at where the keys came from. The attacker held keys these traders were no longer using, sorted by trader, alongside the ones they used every day. That fits a leak from wherever Bloom keeps its keys, or from a provider that holds them for it. Bloom says it is checking whether "a third-party provider may have been compromised." Neither Bloom nor the chain has confirmed a cause.
There is another explanation. Malware on each trader's computer, or a leak of keys the traders exported, could produce the same list, if someone gathered the nine sets and sorted them. The record cannot rule that out.
Either way, the attacker chose whales. If they had Bloom's whole store of keys, they skipped thousands of smaller wallets. If they had only these nine, every one held more than $65,000 in SOL.
07 · SOL onlyThe attacker took SOL and left the dollars
During the drain, the script moved SOL and nothing else. When it ran, the wallets still held about $57,000 in USDC, and memecoins on top. Most of that USDC sat in one wallet, trader 1's 7YoMjE…z1AY.
The attacker did come back for that one. A few minutes after taking its SOL, the same script tried to send a tiny amount of USDC from it to the attacker. The transfer failed. The wallet had too little SOL left to pay for it. Twenty minutes later, the attacker sent the wallet a little SOL to cover fees.
The owner moved first. The fee money landed, and 96 seconds later the USDC was gone, sent to a wallet that has funded this one since January. The network fee for that rescue was paid by the FOMO app, which our labels show the trader also used. When the attacker's test finally went through, about 50 cents was left.
Other owners moved their USDC out too. By the morning, less than $5,000 was left in the 48 wallets.
So the first post's "6 figs in USDC" was too high. Most of the USDC was one wallet's, and its owner got it out.
08 · Where the SOL isWhere the stolen SOL is now
The attacker left the SOL in the collecting wallet for about three and a half hours. Then it moved every coin to a second new wallet, 6nYyCz…moe9. That address had not sent anything when we last checked, at 07:34 UTC.
The only visitors since have been scammers. Look-alike addresses sent both attacker wallets tiny amounts of SOL, hoping the attacker would later copy one of them by mistake. That trick is called address poisoning, and it is common on Solana.
No exchange, bridge or mixer has touched either attacker wallet. The holding wallet can be watched with the Bitquery MCP, which lets you ask an AI assistant where a wallet's money goes next.
09 · What Bloom saidWhat Bloom said about the hack
Bloom answered about three and a half hours after the drain, in a reply on X. It said there was no need for a community relief fund, because Bloom would repay the affected wallets itself, sending the money to new wallets chosen by their owners. It said it was still looking for the cause, including a possible breach at a third-party provider.
Trading on Bloom stopped around the same time. On 25 October, about 90 wallets paid Bloom's fee every hour. The last fee came in at 04:05 UTC, and none had followed three and a half hours later.
Calls of an exit scam started early, so we looked for any sign of one. Neither attacker wallet has ever sent money to Bloom's fee wallet or received money from it. The drain hit nine accounts, out of the thousands of wallets that pay Bloom fees each month. An exit scam usually takes from as many users as it can. None of this proves who the attacker is.
10 · How it comparesBloom against two earlier bot drains
This is the third bot drain we have traced since September. At the end of that month, leaked keys emptied more than 20,000 wallets at TradeWiz, another Solana bot, and the median wallet lost 63 cents. We covered it in the TradeWiz hack. Earlier in September a drainer emptied about 2,400 Ethereum wallets, among them half of all wallets that had ever paid LootBot, a Telegram airdrop bot that kept its users' keys. That story is in the LootBot hack.
Bloom's attacker went the other way. It took the most money of the three from the fewest wallets, and the median loss was about $9,000.
11 · The first reportsChecking the first reports
The first counts on X came from on-chain watchers within hours. The post that started our check, from Inside Calls, got almost everything right. Onchain Lens and Coin Bureau reported the total and the biggest single loss.
| Source | Claim | Record | Verdict |
|---|---|---|---|
| Inside Calls | 48 wallets drained for $950K | 48 wallets, 9,408.23 SOL, about $953K | Right |
| Inside Calls | All of them had used Bloom | All 48 paid Bloom's fee wallet at least once | Right |
| Inside Calls | Only SOL was drained | Only SOL. One later USDC grab failed | Right |
| Inside Calls | Six figures in USDC left behind | $56,853 in USDC when the SOL went | Too high |
| Onchain Lens | 9,408 SOL from 49 victims | 9,408 SOL from 48 wallets; the other senders sent dust | Close |
| Onchain Lens | Largest loss 1,636 SOL, about $166K | 1,636 SOL from one wallet, $166K | Right |
| Onchain Lens | The final number might be much higher | No second collecting wallet or second sweep by 07:34 UTC | Not seen |
| Bloom | Nine affected wallets | 48 wallets that belong to nine traders | Matches |
12 · What it meansWhat the Bloom hack means for bot traders
A trading bot wallet is a hot wallet, and it stays one after you stop trading. Five of these wallets had not traded on Bloom since the first half of 2025, and they were drained with the rest. A key that has been inside a bot can be used by whoever gets hold of it, for as long as the wallet holds money.
Moving funds to a new wallet whose key never touched the bot removes that risk. Keeping only trading money in bot wallets limits it. Bloom plans to send its refunds to new wallets for the same reason.
For the people who build these bots, the old wallets are the warning. Keys for wallets nobody had used in a year were still worth stealing, because someone still had them.
13 · How we traced itHow we traced the Bloom drain
We read every transfer into and out of the two attacker wallets with Bitquery's Solana data. Then we pulled each of the 73 transactions that touched the first wallet from a public Solana node, to see who signed them and what each one left behind. We grouped the wallets by the order of the drain, by Bloom fees paid in the same second, and by where their owners moved money afterwards. Our address labels named the apps involved. Dollar values use the SOL price minute by minute during the drain, about $101.3.
The full Solana history is also sold as files. Bitquery does this kind of tracing for clients through its crypto investigation services, and we traced the CoinDCX hack the same way.
Transfers were read to 07:34 UTC on 26 October. Live balances were read from a public Solana node at 06:20 and 06:33 UTC. Anything after that is not covered.
Dollar values use the SOL price minute by minute during the drain, about $101.3 per SOL. USDC counts at $1.
We group the 48 wallets into nine traders from the order of the drain, from Bloom fees paid in the same second, and from where owners moved money afterwards. The grouping is firm for seven traders; for traders 3 and 7 the drain order is the main evidence.
We identify Bloom's fee wallet by its behaviour: it collects a fee on Bloom trades from thousands of wallets a month. We call wallets Bloom users because they paid it.
We name FOMO only because its wallet paid one network fee. Nothing here suggests it knew about or took part in the drain.
The record shows which wallets moved money and when. It does not show who controls the attacker's wallets or how the keys were obtained.
14 · The addressesWhere to look
These are the main wallets and transactions in this story. Each description links to the explorer, and the holding wallet is marked in green.
Follow the Bloom drain in plain English
Every transfer in this story comes from Bitquery's Solana data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which labels an address carries, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Solana dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any trading bot, protocol, exchange or service.
The findings describe transactions and balances observed on Solana between December 2024 and 26 October 2026. Attributions come from Bitquery's address labels and from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Bloom, Inside Calls, Onchain Lens, Coin Bureau, FOMO or any other named project, company, service or person describe what the public record shows about addresses and transactions linked to them, and what those parties have said in public. They are not statements about any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently. The wallets that took the funds are described by their behaviour and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Was Bloom hacked?
Bloom's users were. On 26 October someone used the private keys of 48 wallets, all used with the Bloom trading bot, to take 9,408 SOL. Bloom says it is investigating whether a third-party provider was compromised. The cause has not been confirmed.
How much was stolen from Bloom trading bot users?
Bloom trading bot users lost 9,408 SOL in the drain, worth about $953,000 at the time. It came from 48 wallets, and those wallets belong to nine traders, each of whom lost a large balance.
Is the Bloom trading bot safe to use?
Trading on Bloom stopped a few hours after the drain, and Bloom has not said what caused it. What the record shows is that any wallet whose key a bot holds can be emptied by whoever gets those keys, including wallets that have not traded in over a year.
Where did the stolen SOL go?
Almost all of it went to one new wallet, 6nYyCz…moe9, a few hours after the drain. It had not sent anything when we last checked, and no exchange or bridge has touched it.
Will Bloom refund the victims?
Bloom said on X that it will fully repay the nine affected wallets, sending the money to new wallets their owners choose, and that no relief fund is needed.
Why did the attacker not take USDC?
We do not know. The script moved only SOL. It later tried to move USDC from one wallet holding about $49,000, but the owner moved the money out first.