blockintAI · Research blog

Bloom Trading Bot Drain: 9,408 SOL Swept in 94 Seconds, Refunded in a Day, and the Thief's Wallet Starts Moving

BlockintAI · 2026-10-27T19:00:00.000Z

Trading bots are popular on Solana because they are fast: they place trades for users from wallets the bot manages. On the evening of October 25, 2026 (US Central Time), wallets of Bloom's users were emptied.

In about a minute and a half, dozens of wallets linked to Bloom, a Solana trading bot that users run through its Bloom Manager app and a Chrome extension, sent their SOL to one address. Bloom says 49 wallets belonging to 9 users lost about 9,408 SOL ($947,000), that the attacker exploited a third-party module through a remote code execution (RCE) vulnerability, and that no private keys were accessed or compromised. By the next afternoon it had refunded every affected user.

We followed the money on Solana's public ledger, from the sweep to the attacker's holding wallet, to Bloom's refund transfers, to the first movements out of the holding wallet on October 27.

Times are in US Central Time (CT), with UTC in brackets where it matters.

Key facts
When Oct 25, 2026, 7:59 PM CT (Oct 26, 00:59:45 UTC) first (failed) test transfer; main sweep 8:03:07 to 8:04:41 PM CT
Loss (Bloom) About 9,408 SOL ($947,000) from 49 wallets belonging to 9 users
Cause (Bloom) A third-party module exploited through a remote code execution vulnerability; no private keys accessed
Drainer 7kY8qx8MqJ7Rz2vMhgHETdZLHcTp1oM78AA9dmE9p8BQ: 9,408.23 SOL in from 48 sending wallets; 73 transactions in total, all on Oct 25 CT
Holding wallet 6nYyCzJJzErbmfxvXqzbAqwoBzNvXUiwr15KCkcgmoe9: received 9,408.21 SOL at 11:30 PM CT Oct 25; held 9,378.21 SOL as of 7:41 AM CT Oct 27
Refunds Bloom says 9,408 SOL; the nine transfers it listed total 9,399.23 SOL by our count, from its published address 35yDUVrT…uTKK, 10:37 AM to 3:33 PM CT Oct 26
Oct 27 Three batches of about 10 SOL left the holding wallet (1:40 AM, 6:42 AM and 7:29 AM CT), each split into ten transfers to new addresses
BlockintAI report Bloom Solana trading bot drain (2026-10-26)

94 seconds

The drainer wallet, 7kY8qx8MqJ7Rz2vMhgHETdZLHcTp1oM78AA9dmE9p8BQ, has 73 transactions. The first, at 7:59:45 PM CT on October 25 (Oct 26, 00:59:45 UTC), was a failed 1-lamport test transfer from one of the affected wallets. More tests followed.

Then the sweep. Between 8:03:07 and 8:04:41 PM CT, 41 transfers of more than 1 SOL landed in the drainer, each signed by a different affected wallet. The largest was 1,636.01 SOL from a single wallet; the next three were 1,039.71, 1,021.72 and 765.65 SOL. Counting every wallet that paid into the drainer, we find 48 sending wallets and 9,408.23 SOL in total. Bloom's own count is 49 wallets.

Every one of those 41 transfers was signed by the wallet that sent the SOL, not by the drainer. Bloom attributes the drain to a third-party module exploited through a remote code execution vulnerability, and says no private keys were accessed or compromised.

The drainer made only two outgoing transfers. At 8:28 PM CT it sent 0.02 SOL back to one of the affected wallets. At 11:30:56 PM CT (04:30:56 UTC) it sent 9,408.21 SOL in one transfer to 6nYyCzJJzErbmfxvXqzbAqwoBzNvXUiwr15KCkcgmoe9. It has held nothing since.

Poisoners arrive in minutes

Within five minutes of that transfer, two addresses that begin with the same characters as the drainer, 7kY82xin… and 7kY84YPL…, sent dust to the holding wallet. That is address poisoning: a lookalike planted in the wallet's history in the hope that its owner copies the wrong one later. The same thing happened on October 27, when lookalikes of each new address the holding wallet paid (GfHD…, HqCb…) sent it dust within minutes. None of these addresses received any of the drained SOL.

What Bloom said

Bloom posted its official statement at 4:12 AM CT on October 26:

"The attack exploited a third-party module through a complex Remote Code Execution (RCE) vulnerability. No private keys were accessed or compromised, and we have ruled out broader exposure of users' wallets."

It put the scope at 49 wallets belonging to 9 users and promised full reimbursement. It also took all of its systems offline and said users will have to log in again to Bloom Manager and the Chrome extension when services return. In an earlier reply it recommended that users move remaining funds to fresh wallets with newly generated private keys. Bloom has not named the module.

At 7:41 AM CT it addressed the attacker directly, saying it had collected "substantial technical evidence, including IP addresses, data centers used," and offering talks on a partial return, with an on-chain memo address, 35yDUVrT…uTKK, as one contact channel.

Refunded the same day

At 3:37 PM CT on October 26, Bloom announced that all 9,408 SOL had been refunded to the 9 users, and listed nine Solana transactions. We read all nine. Each is a single SOL transfer from 35yDUVrT…uTKK, the address Bloom had published for contact, to a different wallet, sent between 10:37 AM and 3:33 PM CT:

Refund SOL
1 1,863.4784
2 1,307.7481
3 1,144.6603
4 1,038.7065
5 1,020.7241
6 864.1566
7 770.0978
8 741.1579
9 648.5000
Total 9,399.2297

By our count that is about 8.8 SOL short of Bloom's 9,408 SOL figure, a gap of about 0.1%.

October 27: the holding wallet moves

For more than 26 hours the holding wallet did nothing. Then:

  • At 1:40 AM CT on October 27 (06:40:55 UTC) it sent 10 SOL to GfHDgSHQ…deFr. About three minutes later that address split it into ten transfers of just under 1 SOL each to ten different addresses, all within 51 seconds.
  • At 6:42 AM CT (11:42:44 UTC) it sent another 10 SOL to HqCbwhMA…P9Am, which split it into ten transfers of about 1 SOL each over the next eleven minutes and was left empty.
  • At 7:29 AM CT (12:29:27 UTC) it sent a third 10 SOL to the same HqCbwhMA…P9Am, which again split it into ten transfers of about 1 SOL each, finishing at 7:33 AM CT.

Small batches split into many fresh addresses are a common way to test a route before moving larger sums. As of 7:41 AM CT on October 27, the holding wallet still held 9,378.21 SOL.

What this means

  • A bot that can move your funds is a target. Bloom says no keys were taken and traces the drain to a third-party module exploited through a remote code execution vulnerability. The transfers were still signed by its users' own wallets.
  • Keep bot wallets small. Trading bots let users create separate wallets for trading. Holding only what you are actively trading in those wallets caps what a breach like this can take. After an incident, Bloom's advice applies: move remaining funds to a fresh wallet with newly generated private keys.
  • Third-party code is part of your attack surface. Bloom says the way in was a third-party module, code the team did not write.
  • A fast refund does not close the case. Bloom says it made its users whole, but 9,378.21 SOL still sat in the attacker's holding wallet as of 7:41 AM CT on October 27, and it had started to move.

If you lost money in a hack or any crypto theft, report it to ic3.gov and the FTC, and file a report at blockint.ai so others can see the addresses involved.

Addresses

Attacker wallets (Solana):

  • Drainer: 7kY8qx8MqJ7Rz2vMhgHETdZLHcTp1oM78AA9dmE9p8BQ
  • Holding wallet: 6nYyCzJJzErbmfxvXqzbAqwoBzNvXUiwr15KCkcgmoe9

Wallets that received SOL from the holding wallet on October 27 and split it onward: GfHDgSHQ…deFr, HqCbwhMA…P9Am

Bloom's refund and contact address: 35yDUVrT…uTKK

Sources