Audit log

Every state-changing event for Bloom Trading Bot: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-11-04 12:26:10Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 465,301,363

   sig

   2ou7s8de6tM7…cSB3BXU2copyexplorer ↗

   hash

   G2K7H4hXPgs4…JFEBi8HCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (9677 B) ▸

   {"actor":"system:backfill","investigation_id":"7a45b890-1a28-41b0-8123-3d68ab995005","kind":"publish","page_slug":"bloom-trading-bot","published_at":"2026-11-04T12:26:10.720Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Bloom Trading Bot","sections":[{"content":"On October 26, 2026, 48 Solana wallets associated with users of the Bloom Telegram trading bot were drained of approximately 9,408 SOL, worth roughly $953,000 at the time (some outlets reported figures between $947,000 and $954,000). Blockchain analytics firm Bitquery reconstructed the attack and found the transfers occurred in a window from 01:03:07 to 01:04:41 UTC, lasting about 94 seconds. Bitquery linked the 48 wallets to Bloom through prior trading-fee payments and grouped them into nine affected traders. It noted that 24 of the 48 wallets had not paid a Bloom trading fee in the preceding month, and five had last paid a fee between January and May 2025, meaning some victims had reportedly stopped actively using the bot well before the drain.","heading":"October 26, 2026 Wallet Drain","severity":"high","sources":[{"credibility":2,"name":"CryptoSlate: Hackers drain 9,400 SOL from bot wallets and a copied key is blamed","type":"news_article","url":"https://cryptoslate.com/hackers-drain-9400-sol-from-bot-wallets-and-a-copied-key-is-blamed/"},{"credibility":2,"name":"Cointelegraph: Bloom bot hackers steal $953K faster than 'Popcorn'","type":"news_article","url":"https://cointelegraph.com/news/bloom-bot-hackers-953k-faster-popcorn"},{"credibility":2,"name":"Cryptometer: Bloom Trading Bot hack drains $953K from 48 Solana wallets in just 94 seconds","type":"news_article","url":"https://www.cryptometer.io/news/bloom-trading-bot-hack-drains-953k-from-48-solana-wallets-in-just-94-seconds/"}]},{"content":"In a statement issued on October 26, 2026, Bloom attributed the incident to a remote-code-execution (RCE) vulnerability in an unspecified third-party module and stated that 'no private keys had been accessed or compromised,' adding that unaffected wallets remained safe. This explanation is directly contradicted by Bitquery's on-chain reconstruction, which found that each of the drain transactions was a plain SOL transfer signed solely by the affected wallet's own private key, with no second signer and no token approval involved. Commentary following the Bitquery report noted that a stolen private key and a compromised signing system can both produce transactions that appear to be authorized solely by the owner's key, so valid signatures alone do not resolve whether an attacker obtained the keys directly or exploited Bloom's signing infrastructure to authorize transfers without extracting the keys. As of early November 2026, Bloom had not published technical detail reconciling its RCE explanation with the single-signer signature pattern Bitquery documented, and no independent post-mortem had been released. Separately, reporting noted that Bloom's withdrawal-address lock feature, which blocks changes to a withdrawal address and imposes a 24-hour cooldown when unlocked, would not prevent a direct transfer out of a wallet by someone holding (or able to use) that wallet's private key, regardless of whether the key was stolen or misused via a compromised signing path.","heading":"Bloom's Explanation vs. Bitquery's On-Chain Analysis","severity":"critical","sources":[{"credibility":2,"name":"CryptoSlate: Hackers drain 9,400 SOL from bot wallets and a copied key is blamed","type":"news_article","url":"https://cryptoslate.com/hackers-drain-9400-sol-from-bot-wallets-and-a-copied-key-is-blamed/"},{"credibility":2,"name":"Cointelegraph: Bloom bot hackers steal $953K faster than 'Popcorn'","type":"news_article","url":"https://cointelegraph.com/news/bloom-bot-hackers-953k-faster-popcorn"}]},{"content":"Bloom paused parts of its service following the incident and pledged to fully reimburse the nine affected users. Later on October 26, 2026, Bloom announced that all nine affected users had been refunded, citing a total of 9,408 SOL returned across nine transactions, with funds reportedly directed to secure wallets designated by the affected users. Reporting describes the reimbursement as completed within hours of the drain being discovered. No regulatory body or law-enforcement action related to this incident had been reported as of early November 2026.","heading":"Response and Reimbursement","severity":"medium","sources":[{"credibility":2,"name":"CryptoSlate: Hackers drain 9,400 SOL from bot wallets and a copied key is blamed","type":"news_article","url":"https://cryptoslate.com/hackers-drain-9400-sol-from-bot-wallets-and-a-copied-key-is-blamed/"},{"credibility":2,"name":"Cryptometer: Bloom Trading Bot hack drains $953K from 48 Solana wallets in just 94 seconds","type":"news_article","url":"https://www.cryptometer.io/news/bloom-trading-bot-hack-drains-953k-from-48-solana-wallets-in-just-94-seconds/"}]},{"content":"As of early November 2026, the precise mechanism by which attackers obtained signing authority over the 48 wallets remains unconfirmed and disputed; Bloom's RCE-module explanation and Bitquery's single-signer on-chain findings have not been reconciled in any published technical account, and no independent third-party post-mortem had been released. Telegram-based Solana trading bots have been targeted by similar incidents previously: Cointelegraph reported that users of the Banana Gun bot lost about $3 million across 11 users in September 2024, and users of Maestro and Unibot lost a combined $1.1 million in October 2023 through exploits of their router contracts. This history suggests custodial or key-handling risk is a recurring structural issue for this category of Telegram trading bot, independent of the specific, still-unresolved cause of the Bloom incident.","heading":"Unresolved Root Cause and Prior Industry Context","severity":"high","sources":[{"credibility":2,"name":"Cointelegraph: Bloom bot hackers steal $953K faster than 'Popcorn'","type":"news_article","url":"https://cointelegraph.com/news/bloom-bot-hackers-953k-faster-popcorn"}]}],"sources_used":[{"credibility":2,"name":"Cointelegraph: Bloom bot hackers steal $953K faster than 'Popcorn'","type":"news_article","url":"https://cointelegraph.com/news/bloom-bot-hackers-953k-faster-popcorn"},{"credibility":2,"name":"CryptoSlate: Hackers drain 9,400 SOL from bot wallets and a copied key is blamed","type":"news_article","url":"https://cryptoslate.com/hackers-drain-9400-sol-from-bot-wallets-and-a-copied-key-is-blamed/"},{"credibility":2,"name":"Cryptometer: Bloom Trading Bot hack drains $953K from 48 Solana wallets in just 94 seconds","type":"news_article","url":"https://www.cryptometer.io/news/bloom-trading-bot-hack-drains-953k-from-48-solana-wallets-in-just-94-seconds/"},{"credibility":2,"name":"CCN: Bloom Telegram bot hack drains Solana wallets","type":"news_article","url":"https://www.ccn.com/news/technology/bloom-telegram-bot-hack-solana-wallets/"},{"credibility":2,"name":"InvestingLive: Solana trading bot Bloom drained of $947,000 in SOL as nine users' wallets emptied","type":"news_article","url":"https://investinglive.com/cryptocurrency/solana-trading-bot-bloom-drained-of-947-000-in-sol-as-nine-users-wallets-emptied/"}],"summary":"Bloom is a Telegram-based Solana trading bot that, on October 26, 2026, saw roughly $953,000 (about 9,408 SOL) drained from 48 wallets linked to nine users in under two minutes. Bloom attributed the incident to a remote-code-execution flaw in a third-party module and denied that private keys were compromised, while on-chain analysis from Bitquery found every drain transaction was signed solely by the affected wallet's own private key with no second signer, a discrepancy that remains unresolved as no independent post-mortem has been published. Bloom paused parts of its service and said it fully reimbursed the nine affected users on the same day.","timeline":[{"date":"2026-10","date_evidence":"The drains ran from 01:03:07 to 01:04:41 UTC on Oct. 26.","date_original":"2026-10-26","event":"48 Solana wallets linked to nine Bloom bot users are drained of approximately 9,408 SOL (~$953,000) over a 94-second window.","source":"CryptoSlate","source_url":"https://cryptoslate.com/hackers-drain-9400-sol-from-bot-wallets-and-a-copied-key-is-blamed/"},{"date":"2026-10","date_evidence":"In an Oct. 26 update, Bloom denied that private keys had been accessed or compromised.","date_original":"2026-10-26","event":"Bloom publicly attributes the incident to a remote-code-execution vulnerability in a third-party module and states that no private keys were accessed or compromised.","source":"CryptoSlate","source_url":"https://cryptoslate.com/hackers-drain-9400-sol-from-bot-wallets-and-a-copied-key-is-blamed/"},{"date":"2026-10","date_evidence":"Later on Oct. 26, Bloom announced that all nine affected users had been fully refunded, claiming a total of 9,408 SOL and linking nine transactions.","date_original":"2026-10-26","event":"Bloom announces that all nine affected users have been fully reimbursed, totaling 9,408 SOL across nine transactions.","source":"CryptoSlate","source_url":"https://cryptoslate.com/hackers-drain-9400-sol-from-bot-wallets-and-a-copied-key-is-blamed/"},{"date":"2026-10-27","date_evidence":"Publication date: October 27, 2026 (Cointelegraph, by Zoltan Vardai, edited by Yohan Yun).","event":"Cointelegraph publishes detailed coverage of Bitquery's on-chain findings, noting the contradiction with Bloom's stated cause.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/bloom-bot-hackers-953k-faster-popcorn"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 29fcb5e3-d0be-41cd-b988-3ab1bc04bff2copy