BTC $80,186 
ETH $2,326 
USDT $0.9993 
BNB $740.72 
XRP $1.29 
USDC $0.9998 
SOL $101.49 
TRX $0.3303 
FIGR_HELOC $1.06 
ZEC $1,229 Hacks & Security · Explained
BloomTrading pledges refunds to nine wallets after $954K Solana drain
The trading bot says it will cover losses itself, but its nine-wallet count differs from the 49 suspected victims flagged by onchain monitors.
Key takeaways
- Refund pledge. BloomTrading says it will send replacement funds to new addresses chosen by the owners of nine affected wallets, rather than asking users to raise a relief fund.
- Numbers diverge. Onchain Lens counted 49 suspected victims and about 9,408 SOL in transfers to one address; the company has acknowledged only nine wallets so far.
- Cause unknown. The investigation includes the possibility that a third-party provider was compromised, but no vulnerability or attacker has been identified.
What happened
BloomTrading, an automated trading bot used by Solana traders, said in an October 26 statement that it will reimburse nine affected wallets after users reported unauthorized withdrawals from accounts connected to the service. The company said the replacement funds would be sent to new, secure addresses designated by each wallet owner, and it rejected suggestions that users should organise a community relief fund, saying it would absorb the losses itself.
The complaints emerged after traders began sharing wallet addresses and transaction records showing withdrawals they had not authorised. Blockchain monitoring account Onchain Lens estimated that roughly 9,408 SOL, about $954,000 at the time, had been transferred from 49 suspected victims to a single address suspected of receiving stolen funds. The largest individual loss cited was 1,636 SOL, valued at approximately $166,000.
Among the complainants, trader Domy said three wallets had been emptied of about 800 SOL and published the addresses while asking for help contacting exchanges to trace the funds. In a separate post, Domy reported another unexpected transfer worth around $64,000 and linked to a Solscan transaction record. Another trader, Pikalosi, described losses affecting members of the Solana trading community and urged others not to blame victims for their trading strategies.
First $122.11Latest $101.44-16.9% over the period
Points are daily observations, not closing prices.
Why it matters
The distance between the company's figure of nine wallets and the 49 suspected victims identified by onchain monitoring leaves unresolved how much of the reported loss will actually be covered. Because the monitoring estimate covers transfers into one suspected receiving address, the true total may be higher still. The incident also highlights a structural risk in bot-based trading: services that automate transactions typically need some form of control over the keys that authorise them, so a compromise at the service or one of its providers can put wallets at risk even when users believe only they hold access.
The pledge is not evidence that money has moved. BloomTrading has not said when payments will be made, how much it expects to refund in total, or how it will verify claims from users.
What the data shows
Onchain Lens put the suspicious transfers at approximately 9,408 SOL, worth about $954,000, originating from 49 wallets and directed to one suspected receiving address. The biggest single loss reported was 1,636 SOL, roughly $166,000 at the time. Domy reported about 800 SOL drained across three wallets, plus a separate transfer of about $64,000. BloomTrading's own figure is nine wallets, a count it has not reconciled with the larger onchain estimate.
Background
Several of the complaints involved wallets whose private keys had reportedly been imported into the trading bot, though investigators have not established whether those keys were exposed. A private key is what allows its holder to authorise transactions; if someone else obtains it, disconnecting a wallet from an application will not stop that party from moving the remaining assets. Some users said their USDC balances were left untouched while SOL disappeared, an observation that has not been confirmed across all affected wallets and does not by itself explain how the transfers were authorised.
The reports follow an Avici wallet exploit in September, when unauthorised transactions reportedly caused more than $1 million in losses among Solana users. A separate disruption at the trading platform BullX involved a different service, and no connection to the BloomTrading incident has been established.
What is still unclear
BloomTrading has not confirmed a root cause, named a compromised employee, or attributed the withdrawals to an outside attacker. Its review includes the possibility that a third-party service provider was compromised, but that remains one hypothesis among several. It is also unclear whether the 49-wallet onchain figure includes addresses unrelated to the company's investigation, additional users, or transactions outside its confirmed scope. Some trading services were reportedly paused during the review, but which functions were affected and whether they have been restored has not been independently verified.
What to watch
The key tests are whether reimbursements actually reach the nine designated addresses and whether BloomTrading publishes a payment schedule, a total refund figure and a claims-verification process. A detailed technical account of the withdrawals, or confirmation of a third-party compromise, would clarify the outstanding questions. Users who believe their keys may have been exposed are being advised to move remaining assets to wallets generated with entirely new keys, since revoking app permissions cannot invalidate a key that is already compromised.
Questions readers ask
How much SOL was drained in the BloomTrading incident?
Onchain Lens estimated about 9,408 SOL, worth roughly $954,000 at the time, moved from 49 suspected victims to one suspected receiving address. The largest single loss reported was 1,636 SOL, about $166,000.
Has BloomTrading paid the refunds yet?
The company pledged full reimbursement to nine wallets and said funds would go to new addresses chosen by owners. It has not disclosed a payment schedule, a total refund amount or a verification method, and the pledge does not show that compensation has already been delivered.
Why do the victim counts differ?
BloomTrading has confirmed nine affected wallets, while onchain monitoring counted 49 suspected victims sending funds to one address. Neither the statement nor the transaction evidence explains whether the larger number includes unrelated addresses or transactions outside the company's investigation.
