BloomTrading bot users lose nearly $1M as wallets get drained

Telegram-based trading bots like Bloom sit in a lineage of custodial automation tools built for Solana and Ethereum sniping, following earlier bots such as Unibot and Banana Gun that also pooled user funds behind a single key-management layer. These bots trade convenience for custody: users fund a bot-controlled wallet rather than signing each transaction themselves, a model that has drawn scrutiny since at least 2023 when similar Telegram bots suffered their own exploits. (per cryptobriefing.com)

Nine Bloom users across 48 to 49 wallets now wait on a pledged reimbursement of roughly 9,408 SOL, with the company ruling out a community relief fund and instead committing to cover losses directly. Traders using the bot face a practical choice: keep funds parked in a custodial automation layer for speed, or withdraw to self-custody and lose the one-click execution Bloom was built for. Other Telegram bot operators now face pressure to audit third-party modules before the next exploit finds them first.

Bitquery confirmed every drained transfer carried a valid signature from the source wallet's own key, yet could not establish how the attacker obtained that signing access, a gap that undercuts Bloom's claim that no private keys were compromised. Calling a 94-second, 48-wallet sweep anything other than a key compromise is a stretch, and the episode revives a familiar tension: bots marketed for speed and convenience still ask users to trust one company's custody of the keys that move their money.

Bitquery's investigation left open exactly how attacker access to signing keys was obtained, and that unanswered question is what will determine whether this was a one-off supply-chain failure or a repeatable attack path for other Telegram bots. Watch whether Bloom names the compromised third-party module publicly and whether the nine affected traders receive the promised 9,408 SOL in full, since a completed reimbursement would close the case while a partial one would reopen it.