BloomTrading Pledges Full Refunds After About $954K Solana Wallet Drain
By Crypto Wire
October 26, 2026
Desk of the Day — Rug Room
On-chain monitors flagged a Monday morning Solana drain tied to BloomTrading, a Telegram trading bot that automates strategies on Solana and EVM networks, after about 9,408 SOL — roughly $954,000 at the reported print — landed in a suspected drainer wallet from about 49 victim addresses. TokenPost and The Crypto Times put the first Onchain Lens alert near 04:26 UTC on October 26, 2026, with the largest single hop near 1,636 SOL (about $166,000, roughly 17% of the tally). BloomTrading later said it had identified nine affected users who operated those wallets, paused some services, and pledged to reimburse verified losses in full to new, secure addresses — while saying the root cause, including a possible third-party compromise, is still under investigation.
This is a Rug Room chapter: bot-adjacent wallet access and recovery status, not a smart-contract exploit on a named DeFi pool. The receiving address cited across wraps is 7kY8qx8MqJ7Rz2vMhgHETdZLHcTp1oM78AA9dmE9p8BQ on Solana. Losses in the reported cluster were concentrated in SOL; some affected users said USDC balances in the same wallets were left untouched. The arithmetic on the rounded SOL and dollar figures implies about $101 per SOL for that snapshot — an estimate from the reported totals, not a separate oracle print. Onchain Lens also warned that the final loss figure could rise above the amount already traced to that drainer.
BloomTrading’s public response came in stages Monday UTC. Between roughly 04:40 and 04:46 UTC, the team said it had identified nine affected users, paused certain services as a precaution, and directed people to open Discord support tickets. At about 06:05 UTC, it clarified that the 49 drained wallets belonged to those nine users rather than forty-nine separate victims — a gap that matches how one trader can run multiple bot wallets. In the same window it committed to full reimbursement of verified losses by sending funds to new wallets designated by the affected users, said it was investigating scope and cause including possible third-party involvement, recommended moving any remaining funds to fresh wallets with newly generated private keys, and rejected “exit scam” framing by pointing to software work since 2018.
User-side pressure arrived in parallel. TokenPost cited trader @domyxbt saying they lost about $80,000 and suspected BloomTrading involvement, pointing to untouched balances in other hot wallets and no use of similar bots. Those are user claims, not a completed forensic attribution. Separately, Crypto Briefing and related wraps describe Bloom as generating private keys for user wallets inside a Telegram automation stack — a custody model that concentrates signing risk even when marketing language sounds non-custodial. Until Bloom publishes a technical postmortem, desks should treat “third-party compromise,” insider access, and key-handling failure as open hypotheses rather than settled cause.
The reimbursement pledge is the recovery beat that matters for holders still waiting on dollars. Bloom has not disclosed a payment schedule, the total it expects to refund, or the verification method for claims. It has not restored a public inventory of which bot functions remain paused. Onchain Lens’s note that traced losses may be incomplete means the 9,408 SOL figure is a current cluster tally tied to one receiving address, not a closed book. For readers who connected wallets to any Telegram trading bot overnight, the practical hygiene is blunt: treat exposed keys as burned, move residual assets to newly generated wallets, and ignore unofficial “recovery” links that arrive while Discord tickets are open.
Context for the bot-security lane stays separate from this morning’s Solana tape. Prior 2026 Telegram-bot incidents — including SIGMA-linked drains and Mithril subkey revocations cited in secondary wraps — show the same recurring failure mode: automation that needs signing power creates a single point of failure across many wallets. Those earlier cases do not prove Bloom’s root cause. They do explain why a ~$954,000 Monday cluster lands as a Rug Room story rather than a venue-listing beat.
What to watch on-chain next: Track whether Solscan shows further inflows into 7kY8qx8MqJ7Rz2vMhgHETdZLHcTp1oM78AA9dmE9p8BQ beyond the reported 9,408 SOL, whether Bloom posts dated reimbursement tx hashes to the nine users’ new wallets, and whether any pause list or postmortem names a compromised vendor, key store, or Telegram path.
Bottom line: BloomTrading says nine users across about 49 wallets were hit in a Monday Solana drain of about 9,408 SOL (~$954,000) into a suspected drainer, and the bot has pledged full verified refunds while investigating — reimbursement txs and root cause still outstanding.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
