Bloom, a crypto trading tool, said an attack on a third-party module led to the theft of about 9,408 SOL, worth roughly $947,000, from 49 wallet addresses belonging to nine users. The team posted the update on X on Oct. 26 and said every affected user will be reimbursed in full.
Official Statement | Security Incident Update
— Bloom (@BloomTrading) October 26, 2026
TL;DR: No private keys were compromised, unaffected wallets are safe, and all affected users will be fully reimbursed by Bloom.
Following our investigation, we have identified the exact attack vector and confirmed the scope of the… pic.twitter.com/llFHfzx6iG
What Bloom says happened
Bloom said its investigation identified the attack vector and the scope of the incident.
"The attack exploited a third-party module through a complex Remote Code Execution (RCE) vulnerability."
The team also said keys were not the point of failure.
"No private keys were accessed or compromised, and we have ruled out broader exposure of users' wallets."
Remote code execution means an attacker can run commands of their choosing on a system they do not control. When the flawed code sits in a module the developer did not write, every product that uses it can be exposed.
The root cause is not settled. Bloom wrote:
"We're still actively investigating the root cause, including whether a third-party provider may have been compromised, especially given the recent wave of security incidents across the industry."
The thread does not explain how funds left user wallets if no private keys were accessed. It also does not list the wallet addresses or transaction links, so the 9,408 SOL figure cannot yet be checked onchain.
Systems offline, refunds promised
Bloom said all of its systems are offline as a precaution. When service returns, users will have to log in again to Bloom Manager and the Chrome extension. The team said it will announce the restoration through its official channels.
On refunds, the company was direct.
"Bloom will fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users."
The question of who pays came up quickly. A user named Doji (@Humanevolvd) suggested a relief fund for people who were drained, with eligibility tied to proof of loss. Bloom answered that none is needed.
"There won't be any need for a relief fund. Bloom will fully reimburse all funds lost by the 9 affected wallets, directly to new, secure wallets designated by their respective owners."
That reply used "9 affected wallets," while the main statement counted 49 wallets. Bloom later cleared it up in a separate post:
"49 wallets belonging to 9 users. So 9 people total."
A user says Bloom drained him
Not everyone is taking the company's account at face value. A trader known as Domy (@domyxbt) wrote on X:
"I found out who drained me for 80k." He added: "It was @BloomTrading."
Bloom's statement does not mention Domy and does not say whether his loss is among the nine accounts. His claim is a user's allegation. The company says it has not found evidence that keys were compromised, and it is still trying to identify the attacker.
"We are also working to trace the stolen funds, explore recovery and freezing options, and identify the attacker."
Bloom also pointed to its record.
"Our team has been developing software since 2018 and operating in crypto since 2021." It added that "Security threats are an unfortunate reality of this industry, even with extensive precautions in place."
Trading bots have been hit before
Automated trading bots hold or touch user funds, which makes them regular targets. Telegram bot Banana Gun was exploited in September 2024 and said it would reimburse affected users. Maestro, another Telegram bot, reported an exploit in October 2023 and compensated users.
For now, Bloom's systems remain offline.
"Once services are safely restored, we will announce it through our official channels."
Gunel Ismayilova
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
