On October 26, 2026, the BloomTrading cryptocurrency trading bot suffered a security breach that resulted in the theft of 9,408 Solana (SOL), worth approximately $954,000, from 49 user wallets. The largest victim lost 1,636 SOL, valued at about $166,000 at the time of the attack. Hackers specifically targeted accounts whose owners had imported their private keys directly into the trading platform.
There won’t be any need for a relief fund. Bloom will fully reimburse all funds lost by the 9 affected wallets, directly to new, secure wallets designated by their respective owners.
We’re still actively investigating the root cause, including whether a third-party provider may have been compromised, especially given the recent wave of security incidents across the industry.
Our team has been building software since 2018. We’re well-established, here for the long run, and would never compromise our integrity for any amount of money.
Our priority right now is to make every affected user whole, determine exactly what happened, and ensure it cannot happen again.
— Bloom (@BloomTrading) October 26, 2026
Following the attack, the BloomTrading development team suspended several automated trading services to prevent further losses. The company also launched an investigation to determine whether the breach originated internally or involved a compromised third-party service provider.
Although the exact cause of the exploit remains unknown, BloomTrading has promised to fully compensate affected users. The platform has already verified nine affected wallets and plans to send reimbursements directly to new, secure wallet addresses created by the victims.
Read also: Drift Hacker Moves $61M in ETH as $195M Remains Frozen
The attackers stole SOL but left USDC untouched
The stolen assets followed an unusual pattern. SOL disappeared quickly from the affected wallets, while stablecoins such as USDC remained untouched.
This selective theft suggests that the attackers may have used an automated script designed to transfer only native SOL. Moving other tokens may require additional transaction steps, more complex interactions, and transaction fees. A bigger attack could also have taken longer and increased the chances of triggering security alerts.
Some users had reported suspicious activity before the major theft. A trader named Felix said he had previously noticed small amounts disappearing from his balance without any corresponding trades.
His observation raises questions about whether the platform had experienced technical security issues before the attack or whether the hackers had conducted smaller test transactions before carrying out the larger theft.
@domyxbt @BloomTrading Bloom
Has a strange way of working, I had started using it and noticed money leaving my account and trades never being placed— felixsama (@felixsama10) October 26, 2026
Private key exposure raises questions about who takes responsibility
The incident highlights the security risks of trading bots that require users to import their private keys. Doing so gives the platform access to the funds controlled by those keys, creating a potential point of failure if its systems or connected services are compromised.
After a breach, determining responsibility can be difficult. Investigators must establish whether the platform’s infrastructure was compromised or whether individual users exposed their credentials through other means.
An X user, Domy, claimed that BloomTrading was responsible for draining $80,000 from their wallet and appealed for help contacting cryptocurrency exchanges. In response, Morgan argued that blaming the platform immediately could overlook other possible causes, noting that some traders operate multiple trading terminals on unsecured computers. These devices could be vulnerable to malware that steals wallet credentials.
@domyxbt @BloomTrading I mean bro you are just false accusing another platform of drainage with 0 evidence, who knows how much terminals you have on your computer
I think instead of actively tweeting it was bloom try to do your due diligence and figure out the real suspect before false accusations
— 𖤝 (@MorganJonesTale) October 26, 2026
Could BloomTrading’s refund promise encourage riskier trading?
BloomTrading’s promise to fully compensate affected users has shifted attention from the stolen funds to how quickly victims can recover their losses. X user Txnvoid, who initially expressed shock after losing $77,000 and questioned how the theft happened, began asking where to claim a refund shortly after the company announced its compensation plan.
i just got drained for $77,000 USD
https://t.co/5oUnN4i6fv
what the fuck just happened??
— txnvoid (@txnvoid) October 26, 2026
This reaction highlights a potential moral hazard in cryptocurrency trading. When users expect platforms to cover losses, they may become less cautious about the risks of importing private keys into third-party trading bots. If compensation becomes the expected response to security breaches, platforms may also face pressure to prioritize refunds without adequately addressing the vulnerabilities that caused the losses.
However, compensation alone does not resolve the underlying security problem. Until the breach is explained and the vulnerability addressed, traders remain exposed to similar risks. Meanwhile, CoinDCX recently denied allegations of a new security breach after blockchain investigators flagged approximately $16 million in Tether (USDT) transfers from wallets associated with the Indian cryptocurrency exchange
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
