Overview
- Blockchain monitors linked about 9,408 SOL, worth roughly $950k–$954k, to transfers out of roughly 48–49 wallets associated with BloomTrading users on Monday, October 26, 2026.
- BloomTrading paused some services, opened an investigation, and said its review found an exploited third‑party software module that enabled remote code execution.
- The company has pledged to fully reimburse nine affected wallets by sending replacement funds to new addresses designated by owners, but it has not published a payment schedule or completed reimbursements.
- Independent on‑chain tracing and Bloom’s count differ because monitors report 48–49 drained addresses while Bloom says those addresses belong to nine users and has not released a detailed technical postmortem to reconcile the gap.
- The incident highlights risks of custodial trading bots that generate and hold users’ private keys and use third‑party modules, and it could prompt users to move funds to wallets with keys they control and push tighter scrutiny of bot integrations.