Bloom Trading Bot Drain: 9,408 SOL Refunded
On this page
On October 26, 2026, attackers drained about 9,408 SOL (around $947,000) from 49 wallet addresses belonging to 9 users of the Bloom trading bot. Bloom says the attack used a flaw in a third-party module, that no private keys were compromised, and that it refunded 100% of the stolen SOL to all 9 users the next day. Independent on-chain reports do not fully match Bloom's account yet, so treat the cause as Bloom's own explanation for now.
This roundup covers the Bloom incident, what users of any Solana trading bot can learn from it, and two fee changes at Pump.fun from the past two weeks.
Bloom security incident: what Bloom says
Bloom is a Solana trading bot used through Telegram and, according to news coverage, a browser extension. Here is the timeline from its official X account, @BloomTrading:
| Date | What happened | Source |
|---|---|---|
| Oct 26, 2026 | Funds drained from 49 addresses of 9 users, about 9,408 SOL | Bloom statement |
| Oct 26, 2026 | Bloom blames a Remote Code Execution (RCE) flaw in a third-party module and says no private keys were accessed | Same statement |
| Oct 26, 2026 | Bloom says it will reimburse 100% to new wallets chosen by the affected users | Same statement |
| Oct 27, 2026 | Bloom says all 9,408 SOL was refunded and lists 9 refund transactions on Solscan | Refund post |
Bloom also says it is tracing the stolen funds and looking at recovery and freezing options. It did not name the third-party module.
What is not confirmed yet
Crypto news sites and on-chain analysts reported slightly different numbers: some counted 48 wallets instead of 49, and dollar figures range from about $947,000 to $954,000, depending on the SOL price used. Some reports say each drain was a normal SOL transfer signed by the affected wallet. That does not fit easily with "no private keys were accessed", and Bloom has not published a detailed technical write-up that explains how the transfers were signed.
None of this changes the main fact for users: Bloom says affected users were paid back in full, and the refund transactions are public. But "no keys were compromised" is Bloom's claim, not an independent audit result.
What any trading bot user can do
Bloom is not the only bot that holds or signs for a trading wallet. Most Solana bots, including BONKbot and Trojan, create a wallet that the bot can trade from. A few habits limit the damage if any of them has a problem:
- Keep only trading money in the bot wallet. Move profits and savings to a wallet the bot cannot touch.
- Follow the official account only. During incidents, fake "refund" and "claim" links spread fast. Bloom said refunds would go to secure wallets chosen by the affected users, so a public "connect your wallet to claim" link is a red flag.
- Turn on every security option the bot offers. BONKbot, for example, offers two-factor authentication to protect funds if your Telegram account is compromised.
- Check what an extension can read. A browser extension that trades for you can see the trading sites you open. Install it only from the link on the official site.
- Never paste a seed phrase into a bot, site or support chat.
Pump.fun adds a 0.45% app platform fee
Pump.fun's official fee page (last updated October 17, 2026) adds a Platform Fee from October 17, 2026 on every trade placed in the Pump.fun web app or mobile app. It comes on top of the normal bonding curve and PumpSwap fees.
| Who | Platform Fee |
|---|---|
| Wallet with no referral code applied | 0.45% of the trade |
| Wallet that applied another user's referral code | 0.40% of the trade |
| Trades through Pump.fun Terminal or third-party interfaces | Not charged |
| Perpetuals orders | Not charged (separate perps fees) |
Example, with our own numbers: you buy 1 SOL of a coin that is still on the bonding curve. The bonding curve fee is 1.25%, so in the app you now pay 1.25% + 0.45% = 1.70%, or 0.017 SOL. With a referral code applied it is 1.65%. Through Terminal or a trading bot that trades the Pump.fun contracts directly, the Pump.fun Platform Fee does not apply, but the bot's own fee does: Trojan, BONKbot and Photon each charge 1%, according to their docs.
Pump.fun perps fees and Polygon trading
- Perpetuals: the same fee page says Pump.fun's perps run on Hyperliquid. Pump.fun charges a builder fee of up to 0.05% of each order's notional value and up to 0.25% on each bridge transfer to or from Hyperliquid. Hyperliquid's own trading and funding fees are separate. Some news sites reported a 0.10% builder fee; the official page says up to 0.05%.
- Polygon tokens: on October 30, 2026, Pump.fun said Polygon is live in its app, so users can trade Polygon tokens from their USDC balance without bridging (Pump.fun on X).
Perps use leverage, and leverage can wipe out your margin quickly. Read how liquidation works before you try them.
FAQ
Is Bloom trading bot legit?
Bloom is a real Solana trading bot with an official X account, not a fake clone. It was hacked on October 26, 2026, and says it refunded all affected users in full. Whether it is safe to use now depends on the fix for the third-party module, which Bloom has not described in detail.
Were Bloom users' private keys stolen?
Bloom says no private keys were accessed or compromised and that unaffected wallets are safe. Some on-chain analysts question this, because the drain transactions looked like normal signed transfers. There is no independent report yet that settles it.
How much does Pump.fun charge now?
On the bonding curve, 1.25% per trade, plus a 0.45% Platform Fee in the Pump.fun app (0.40% with a referral code) from October 17, 2026. Graduated coins on PumpSwap pay a tiered fee from 1.25% down to 0.30%, depending on market cap. Terminal and third-party interfaces do not pay the Platform Fee.
Keep learning
- BONKbot fees and features
- Photon fact sheet
- Trojan sniper settings: slippage, fees and MEV
- Solana copy trading bots: how they work and the risks
Facts come from Bloom's official X posts and Pump.fun's official fee page, checked on the update date above. Unconfirmed points are labelled. This is not investment advice.