BloomTrading, a cross-chain Telegram trading bot for SOL and EVM users, faced wallet-drain allegations on Oct. 26 after users said assets had been moved out of their wallets. In replies posted on X, the company said it was investigating the incident, that other wallets remained safe, and that some services had been temporarily disabled as a precaution. Users were asked to open tickets in Discord for follow-up support.
BloomTrading later said it had identified nine affected users and would fully reimburse them by sending compensation to new secure wallets designated by those users. The company also denied that the incident was a rug pull or exit scam.
On-chain figures differ from the company’s count
On-chain tracking account Onchain Lens said a suspected thief address had received about 9,408 SOL from roughly 49 victims, equal to about $954,000. The largest single transfer was about 1,636 SOL. According to the tracker, the final total could rise further, and users were urged to disconnect wallet connections and move funds.
That leaves a gap between BloomTrading’s public count of nine users and on-chain monitoring that points to about 49 wallets. The root cause has not been confirmed by the company.
Users posted loss claims on social media
Several users on social media said their assets had been transferred out. User @domyxbt said the loss was about $80,000 and asked for help contacting exchanges.
The same user later said they believed the incident was about 95% related to Bloom, citing three reasons: other hot wallets were untouched, no other similar bots had been used, and Bloom was the only bot used. Another on-chain transfer of about 640.45 SOL, worth roughly $64,000, was reported as moving to an account beginning with 7kY8qx…
BloomTrading says investigation is ongoing and promises full repayment
In its thread, BloomTrading rejected claims that it had disappeared with user funds. The company said it had been building software since 2018 and would not destroy its reputation over money. It added that no relief fund was needed because compensation would be sent directly to users’ newly designated secure wallets.
BloomTrading also said the root cause was still under review, including whether a third-party vendor may have been compromised, and referred to the recent wave of security incidents across the industry. In another post, it repeated that this was not an exit scam and said full reimbursement had been promised to the nine affected users it had identified.
As of publication, the company’s position was that it had identified nine people, was continuing to review all reported wallet activity, had not yet confirmed the root cause, and would fully reimburse all users confirmed to have been affected.
Media roundups point to roughly 48 to 49 wallets
CryptoBriefing compiled similar figures, putting the incident at about 48 to 49 wallets, around 9,408 SOL, and roughly $950,000 to $954,000 in losses. Its summary said nearly all of the losses were in SOL, while some USDC appeared untouched. It also pointed to custodial risk tied to platforms that generate private keys for users.
Custodial bot risk back in focus
BloomTrading describes itself as a cross-chain trading automation bot on Telegram for SOL and EVM. Products in this category often generate or custody private keys on behalf of users. That can make trading easier, but it also concentrates risk. If a vendor or an internal link in the stack is compromised, multiple hot wallets can come under pressure at the same time.
BloomTrading has promised full reimbursement and paused part of its service. The next points to watch are the root-cause report, whether compensation is actually delivered on-chain, and whether the scale seen in wallet activity expands beyond the current estimates.