BloomTrading Says Users Repaid After 9,408 SOL Theft
Bloom says all nine affected users have been repaid; its published payments came from an address different from the traced holding wallet.
On 26th October 2026, BloomTrading said it had repaid all nine users affected by the theft of about 9,408 SOL from wallets linked to its trading service. The company published nine transaction links with its announcement, following its earlier promise to cover the losses in full.
The nine linked transfers completed successfully, sending a combined 9,399.2297 SOL to nine receiving addresses. That is about 8.77 SOL below Bloom's announced total, a difference its post does not explain. The records alone do not establish whether other payments were made or any user was underpaid.
The payments began at 15:37 UTC and ended at 20:33 UTC on 26th October 2026, according to the transaction records linked in Bloom's completion announcement, which followed at 20:37 UTC.
Before the refund announcement, an X user posting as Domy reported that his funds had been drained and appealed for help contacting exchanges.
What Bloom says caused the theft
In its security update on 26th October, Bloom attributed the theft to a remote code execution vulnerability in a third-party software module: a flaw allowing an attacker to run code in the affected system. It said 49 wallet addresses belonging to nine users were affected, and valued the stolen SOL at approximately $947,000 at the time.
The company said in the same update that no private keys had been accessed or compromised and that other users' wallets were safe. It did not name the affected module or describe the steps that enabled the transfers.
Bloom also said on 26th October that it had taken all systems offline as a precaution and would announce their restoration through its official channels.
Blockchain data provider Bitquery's reconstruction placed the withdrawals within 94 seconds. It also found five affected wallets whose last trading-fee payments to Bloom dated from January to May 2025.
Where the stolen SOL went
Bitquery traced the theft to a collecting wallet and then a second address ending in moe9. A Solana transaction record confirms that 9,408.21 SOL moved between those addresses at 04:30 UTC on 26th October.
Bloom had also offered on 26th October to discuss a deal with the attacker: a partial repayment in return for not pursuing legal action it could control, within the law and on agreed terms.
A balance check at 06:09 UTC on 27th October showed approximately 9,408.21 SOL in that second address, after the nine linked payments had completed. Those transfers came from a different address, ending in uTKK.
