Bloom bot hack drains 9,408 SOL from 49 wallets in under a minute

Telegram trading bots are convenient because they hold the keys and trade for you. The Bloom bot hack on Monday showed the other side of that bargain: an attacker emptied 49 wallets in less than a minute, and Bloom says the entry point was not its own code but a module it relied on.

What happened

About 9,408 SOL, worth roughly $947,000 by Bloom's estimate, left the affected wallets early on Oct. 26, according to TSN and Bitcoin.com News. Early alerts counted 49 victims and losses near $954,000, but Bloom later clarified that the 49 wallets belonged to just nine people. The largest single drain was 1,636 SOL.

Bloom said the attacker exploited a remote code execution flaw in a third-party module and insisted that no private keys were accessed. It has not named the module or its supplier. TSN, which read the on-chain history of the address flagged by Onchain Lens, found that most of the coins landed within a window of roughly 51 seconds shortly after 01:03 GMT, then stayed put until 04:30:56 GMT, when the full balance moved to a second address in one transfer.

All Bloom systems are offline as a precaution, and TokenPost reported that customers must sign back in to Bloom Manager and its Chrome add-on once the service is restored. Bloom has advised affected users to move remaining funds to freshly generated wallets.

Why it matters

Bloom has pledged to reimburse 100% of the stolen funds to wallets chosen by the victims and is trying to trace and freeze the coins. That last part is hard. Unlike USDC, native SOL has no central issuer able to block transfers, so recovery depends on the funds reaching an exchange willing to act, TSN noted. The idle period of about three and a half hours offered the best chance to act, and they moved out before Bloom publicly raised the third-party theory.

The Bloom bot hack also raises a design question. If keys stayed safe, Bitcoin.com News asked, how did compromised third-party software gain authority to move nearly $1 million? Bloom has not explained the mechanism. Supplier and tooling attacks were the main driver of the $1.18 billion in third-quarter crypto losses tallied by Hacken, as we reported in our story on Hacken's Q3 crypto losses, and October has already brought the Initia MoveVM exploit.

What's next

Users are waiting for three things: the refund timeline, a restart date and a full post-mortem naming the vulnerable component. Neither date has been given. Exchanges' compliance teams will be watching the second wallet, where tracing now begins. The Bloom bot hack is a reminder that custodial bots add a layer of counterparty risk on top of market risk. The on-chain timeline is laid out in TSN's investigation.