BloomTrading has promised to reimburse affected users after reports of Solana being drained from wallets associated with its trading service, while the platform investigates the cause.
An October 26 announcement reproduced by TechFlow describes nine affected users across 49 wallets and says replacement funds will be sent to new addresses designated by those users. The pledge does not establish that the payments have been completed.
Preliminary blockchain monitoring cited by several reports estimated about 9,408 SOL in suspicious transfers, valued at roughly $954,000 at the incident's reported prices. That dollar estimate is historical and should not be confused with a current valuation or a finalized recovery-adjusted loss.
Users and wallet addresses are different counts
The reports have not consistently distinguished people from addresses. TechFlow's account describes nine users holding 49 affected wallets; other coverage refers to nine wallets or describes the larger figure as victims.
A single person can control multiple wallets. Conversely, a list of addresses receiving or sending funds does not by itself identify the people behind them. There is no basis here for turning the address count into a claim that 49 individual customers have been confirmed.
The difference matters for the scope of the reimbursement promise. Establishing who qualifies requires attributing wallets and losses to users, rather than merely counting transactions or repeating the largest figure circulating in early reports.
The investigation has not established the entry point
BloomTrading's reported statement says the inquiry includes whether a third-party service provider was compromised. That is a line of investigation, not a confirmed cause.
Reports also describe some functions being paused as a precaution. They do not establish that every trading or wallet function stopped, or independently confirm the restoration status of each service. An operational precaution can reduce exposure while leaving the underlying question unresolved.
Some complainants have connected their losses to use of the bot. A user's account is evidence of their experience and a reason to investigate; it does not by itself prove which system disclosed a key or authorized a transfer.
Wallet access can outlast an interface session
A trading service's interface and the authority used to sign a blockchain transaction are separate things. If a private key has been disclosed, closing an app or disconnecting an interface does not change the key that controls the address.
That distinction should not be read as a finding that BloomTrading exposed private keys in this incident. The entry point remains unconfirmed. It explains why an investigation needs to identify the actual permissions and credentials involved rather than stop at the name of the application a user happened to use.
Our guide to wallet keys, backups and recovery explains the authority carried by signing and recovery information. A familiar support identity or knowledge of a user's loss does not establish that a person requesting that information is legitimate.
A repayment promise needs a payment record
The next material evidence will be a verified account of the cause, a reconciled affected-user list and records establishing that promised reimbursements reached the intended new wallets. Until then, the confirmed public development is the pledge and investigation, rather than a completed resolution of the incident.