On 26 October 2026 Bloom published a security statement on X, timestamped 9:12 UTC. The bot had lost approximately 9,408 SOL, which Bloom priced at about $947,000. The loss sat in 49 wallet addresses belonging to nine users. Bloom said the entry was a remote-code-execution flaw in a third-party module, that no private keys were accessed or compromised, and that it had ruled out a broader exposure of users’ wallets. Every affected user, it said, will be reimbursed in full. This page will not describe the flaw, and it will not name the module.
Bloom is a trading bot for Solana. The job of the product is to place trades for the person using it. Bloom’s own follow-up named two places a user logs in: Bloom Manager, and a Chrome extension. The same product is widely used from Telegram. A bot that can send SOL is software with the power to spend. That power lives on a machine for as long as it is switched on. See What is Solana (SOL)? for the chain those coins move on. Solana did not halt on 26 October. The bot did.
What happened
Bloom’s own list is short, and it is the list this page will use. Affected: 49 addresses, nine users. Total: about 9,408 SOL, about $947,000 on the company’s figure. Cause, in the company’s words: a third-party module, reached through a remote-code-execution flaw. Refunds: 100 percent, paid by Bloom directly to secure wallets the affected users designate. The team also said it was tracing the coins, looking at freezes, and trying to identify who did it. A later note the same day said every Bloom system was offline as a precaution. When service comes back, Bloom said, users will have to log in again to Bloom Manager and to the Chrome extension. A login screen that appears before that announcement is not the announcement.
The sentence that needs reading twice is the one about keys. Bloom says the private keys were not accessed and were not compromised. A transfer of SOL is still only valid if something signs it. Both statements can sit together if the signing happened where the bot already had the power to sign, without a copy of the key leaving as a file the user can see stolen. Bloom has not published that sequence. This page will not invent it. The product fact does not depend on the missing paragraph. Software that can send is a hot wallet. The key file staying where it was does not make the coins cold. See How crypto wallets actually work.
Bloom’s note also says the team has been building software since 2018 and operating in crypto since 2021. That is a biography the company offered its users. It is not a description of where the keys sit, and it is not a guarantee the next module is any quieter.
Why it matters
If you are one of the nine, you are waiting on a company payment to a wallet you name. That payment is Bloom’s promise. Solana will not mint the 9,408 SOL back, and a freeze somewhere else is not the same thing as the coins arriving. If you use Bloom and you were not in those 49 addresses, the company says your wallets were not part of the exposure. The systems were still taken offline. Wait for Bloom’s own channels to say they are back, then log in there. A message that offers to “restore” the bot, and asks for a recovery phrase, is the second incident. See A practical checklist for keeping crypto safer. See A wallet signature is not a handshake if a connect button and a send still feel like the same click.
If your SOL sits in a wallet this bot cannot sign for, this page did not spend it. If the bot can sign, the coins are online whether or not you think of the bot as “your wallet”. An exchange balance is an IOU, not a wallet is the exchange version of the same shape: a company, or a piece of company software, can move the coins, and the number you see is a claim on that arrangement. The same week, BTCPay said old servers were drained. Different software, same fact about a machine that can spend. Binance’s hot-wallet loss is the exchange-sized version of a company promising to cover what left. Bloom’s promise is narrower, and it is named: nine users, the full amount, to wallets they designate.
What happens next
A restart, on Bloom’s own account, and a login that the project has already said will be required. Reimbursement to the nine, if the promise is kept. A technical note, which was not the 26 October statement. More tracing, which may or may not produce a freeze. Watch @BloomTrading and the domains you already used before this week. We will not treat “no keys were compromised” as “a trading bot cannot move the coins”, and we will not treat a biography that starts in 2018 as a custody audit.
Not a recommendation to use, reinstall, or abandon Bloom. Not a finding that every Solana bot was hit. Not a description of the module. The company’s own account, on the morning of 26 October, was a number, a user count, a class of flaw, and a promise to pay.
