BloomTrading promises refunds after $954K Solana wallet drain

BloomTrading has promised to reimburse nine affected wallets following reports that nearly $1 million in Solana was drained from users of its cryptocurrency trading bot.

BloomTrading, in an October 26 statement, said it would fully compensate nine affected wallets by transferring replacement funds to new addresses designated by their owners.

The announcement followed complaints from Solana traders who discovered unauthorized withdrawals from wallets associated with the automated trading platform. 

Separately, blockchain investigators estimated that 9,408 SOL, worth approximately $954,000, had reached an address suspected of receiving stolen cryptocurrency from 49 victims.

In a subsequent October 26 security update, BloomTrading confirmed that the attack affected 49 wallet addresses belonging to nine users, resolving the discrepancy between the number of addresses identified by blockchain investigators and the company’s initial count.

Meanwhile, the company attributed the theft to a remote code execution (RCE) vulnerability in a third-party software module. Its investigation found no evidence that private keys had been accessed or compromised, and BloomTrading said wallets outside the affected group remained safe.

BloomTrading users report nearly $1 million in stolen SOL

Reports of the suspected compromise began circulating after several traders shared wallet addresses and transaction records showing unexpected withdrawals.

Blockchain monitoring account Onchain Lens identified approximately 9,408 SOL transferred from 49 suspected victims, with the largest individual loss reaching 1,636 SOL, worth around $166,000 at the time. The estimate covers transactions linked to one suspected receiving address, meaning the final loss could be higher.

Among the complainants, trader Domy said three wallets had been drained of approximately 800 SOL. The trader published the affected addresses and requested assistance contacting cryptocurrency exchanges to help trace the missing funds.

In a separate post, Domy reported another unexpected transfer worth approximately $64,000 and shared a Solscan transaction reference. 

Another trader, Pikalosi, described losses affecting members of the Solana trading community, including complaints involving Domy and another account. The trader urged others not to blame victims for their trading strategies.

BloomTrading promises refunds to nine affected wallets

Following the complaints, BloomTrading said it would reimburse the owners of nine affected wallets directly through newly designated, secure addresses.

The company rejected suggestions that users needed to organize a community relief fund, saying it intended to cover the losses itself.

BloomTrading has since confirmed that a third-party module was exploited through a remote code execution vulnerability, establishing the cause of the unauthorized transfers.

According to the company, the incident resulted in losses of approximately 9,408 SOL, valued at $947,000, across 49 wallet addresses belonging to nine users.

“All affected users will be fully reimbursed by Bloom,” the company stated, confirming that compensation would cover 100% of the stolen funds.

The reimbursements will be transferred directly to secure wallets designated by the affected users. BloomTrading has not disclosed a payment schedule or confirmed that the refunds have been completed.

Reports indicate that some trading services were temporarily paused while the company investigated. The precise functions affected and their restoration status have not been independently confirmed.

Imported private keys raise questions about wallet security

Although initial complaints raised concerns about private keys imported into trading bots, BloomTrading’s latest investigation found no evidence that private keys were accessed or compromised during the incident.

The company identified a third-party remote code execution vulnerability as the attack method and said there was no wider exposure affecting users’ wallets. It has not disclosed the identity of the affected software provider or technical details explaining how the vulnerability enabled the unauthorized transfers.

A private key allows its holder to authorize transactions. If an unauthorized party obtains it, disconnecting a wallet from an application will not prevent that party from moving the remaining assets.

The risks associated with Telegram trading bots include the storage and handling of private keys used to automate transactions. A compromised service may expose wallets that otherwise appear accessible only to their owners.

Some users reported that USDC balances remained untouched while SOL disappeared. The observations have not been established across all affected wallets and do not identify the method used to authorize the transfers.

Similar concerns followed an Avici wallet exploit in September, when unauthorized transactions reportedly caused more than $1 million in losses among Solana users.

The recent BullX service disruption involved a different trading platform and did not establish any connection to the BloomTrading incident.

What happens next in the BloomTrading investigation?

BloomTrading said it was continuing efforts to trace the stolen cryptocurrency, explore recovery and freezing options, and identify the attacker responsible for the incident.

Although the company has established the attack method and confirmed the affected accounts, it has not disclosed whether any stolen funds have been recovered or frozen.

The company said its team has been developing software since 2018 and operating in cryptocurrency markets since 2021. It reaffirmed its commitment to user safety, transparency and continued operations while pursuing the recovery of the stolen assets.