Bloom Trading Incident Exposes the Hidden Risks of Automated Crypto Wallets
A 94-second Solana wallet-drain raises urgent questions about trading-bot security and private-key custody.
W3 Meteor ID: BLOOM-1027202629280
Date & Time: October 26, 2026, approximately 01:03–01:05 UTC (main wallet-drain sequence).
Origin: An unidentified attacker used the private keys associated with wallets used through Bloom, a Telegram-based crypto trading bot. How those keys were obtained remains unconfirmed.
Visibility: Solana traders, Bloom users, automated trading-bot operators, wallet-security teams, and Web3 developers face the clearest implications. The incident also concerns anyone delegating transaction signing to third-party services.
Trajectory: On October 26, an attacker drained 48 wallets associated with nine traders, taking approximately 9,408 SOL in a rapid sequence lasting around 94 seconds. On-chain analysis showed that the transactions were authorized by the wallets’ own keys, while the precise source of the compromise remained unresolved.
Direction: The incident could intensify scrutiny of trading-bot custody practices, third-party infrastructure, and the risks of leaving automated wallets funded. Bloom’s investigation and promised reimbursements will be important developments, but neither establishes how the keys were compromised.
Speed: The theft unfolded in approximately 94 seconds, demonstrating how quickly automated transfers can turn compromised credentials into substantial losses. The investigation and accountability process will move more slowly, as researchers trace funds and the service works to establish what happened.
Magnitude: Approximately 9,408 SOL—valued at roughly $953,000 in the investigation—was taken from 48 wallets. The scale is significant, but the deeper warning is structural: a blockchain can execute validly signed transactions correctly even when an attacker controls the signing keys.
Altitude: The consequences extend beyond one trading bot or blockchain. Any Web3 service that handles private keys or signs transactions on users’ behalf faces related custody and infrastructure risks. The incident could strengthen demand for isolated trading wallets, tighter key controls, and clearer security disclosures.
Cock-a-Doodle-Doo: The blockchain did exactly what it was designed to do: honor valid signatures. That is precisely why wallet security matters. When convenience gives a third party access to the keys, the weakest link may sit outside the chain—and 94 seconds can be enough to expose it.
