BloomTrading has promised to reimburse nine affected wallets following reports that nearly $1 million in Solana was drained from users of its cryptocurrency trading bot.
Summary
- Blockchain investigators linked approximately 9,408 SOL in suspicious transfers to 49 reportedly affected wallets.
- BloomTrading pledged full reimbursement for nine wallets while investigating a possible third-party security compromise.
- One reported victim lost 1,636 SOL, valued at approximately $166,000 during the incident.
- The platform has not confirmed the cause of the drains or reconciled the different victim counts.
BloomTrading, in an October 26 statement, said it would fully compensate nine affected wallets by transferring replacement funds to new addresses designated by their owners.
The announcement followed complaints from Solana traders who discovered unauthorized withdrawals from wallets associated with the automated trading platform.
Separately, blockchain investigators estimated that 9,408 SOL, worth approximately $954,000, had reached an address suspected of receiving stolen cryptocurrency from 49 victims.
BloomTrading users report nearly $1 million in stolen SOL
Reports of the suspected compromise began circulating after several traders shared wallet addresses and transaction records showing unexpected withdrawals.
Blockchain monitoring account Onchain Lens identified approximately 9,408 SOL transferred from 49 suspected victims, with the largest individual loss reaching 1,636 SOL, worth around $166,000 at the time. The estimate covers transactions linked to one suspected receiving address, meaning the final loss could be higher.
Among the complainants, trader Domy said three wallets had been drained of approximately 800 SOL. The trader published the affected addresses and requested assistance contacting cryptocurrency exchanges to help trace the missing funds.
In a separate post, Domy reported another unexpected transfer worth approximately $64,000 and shared a Solscan transaction reference.
Another trader, Pikalosi, described losses affecting members of the Solana trading community, including complaints involving Domy and another account. The trader urged others not to blame victims for their trading strategies.
BloomTrading promises refunds to nine affected wallets
Following the complaints, BloomTrading said it would reimburse the owners of nine affected wallets directly through newly designated, secure addresses.
The company rejected suggestions that users needed to organize a community relief fund, saying it intended to cover the losses itself.
“We’re still actively investigating the root cause,” BloomTrading stated, acknowledging that the inquiry would examine whether a third-party service provider had been compromised.
The reimbursement pledge does not establish that compensation has already reached users. BloomTrading has not disclosed a payment schedule, the total amount it expects to refund, or the method it will use to verify claims.
Its identification of nine affected wallets differs from the 49 suspected victims cited in preliminary blockchain monitoring. Neither the company’s statement nor the available transaction evidence explains whether the larger figure includes unrelated addresses, additional users, or transactions outside its confirmed investigation.
Reports indicate that some trading services were temporarily paused while the company investigated. The precise functions affected and their restoration status have not been independently confirmed.
Imported private keys raise questions about wallet security
Several complaints involved wallets whose private keys had reportedly been imported into the trading bot, although investigators have not established whether the keys were exposed.
A private key allows its holder to authorize transactions. If an unauthorized party obtains it, disconnecting a wallet from an application will not prevent that party from moving the remaining assets.
The risks associated with Telegram trading bots include the storage and handling of private keys used to automate transactions. A compromised service may expose wallets that otherwise appear accessible only to their owners.
Some users reported that USDC balances remained untouched while SOL disappeared. The observations have not been established across all affected wallets and do not identify the method used to authorize the transfers.
Similar concerns followed an Avici wallet exploit in September, when unauthorized transactions reportedly caused more than $1 million in losses among Solana users.
The recent BullX service disruption involved a different trading platform and did not establish any connection to the BloomTrading incident.
What happens next in the BloomTrading investigation?
BloomTrading has not identified a confirmed vulnerability, implicated a particular employee, or attributed the suspicious withdrawals to an external attacker.
The company’s investigation includes the possibility of a third-party compromise, but that remains one of several potential explanations.
Users whose private keys may have been exposed should transfer remaining assets to wallets generated with entirely new keys. Revoking application permissions alone cannot invalidate a compromised private key.
BloomTrading said its priority was to compensate affected users, determine what happened, and prevent another incident. It has not announced a completed investigation or published a detailed technical account of the unauthorized transactions.