Is Bloom safe to connect?
Telegram trading bot · Solana, Ethereum, BSC, Base, Robinhood Chain, Arc, HyperEVM, Ink. Checked 2026-10-27; every line links its source.
⚠ Oct 26, 2026: Bloom says a remote code execution flaw in a third-party module let an attacker drain 49 wallets of 9 users (about 9,408 SOL). It says no private keys were compromised, has refunded all 9,408 SOL, and took its systems offline as a precaution; log in again only through bloombot.app when it announces services are back.
Worst case: Bloom holds the private keys of the wallets it creates. If Bloom, your Telegram account, the Chrome extension or a saved copy of the key is compromised, the wallet can be emptied. A locked withdraw address only helps if you set and locked it beforehand.
Official website, Telegram, X and docs, with anything we could not verify left out: Bloom official links.
Safe setup in 3 steps
- Set a withdraw address to a wallet you control and lock it right away, so changing it needs the 24-hour cooldown
- Get the bots only from bloombot.app or docs.bloombot.app (@BloomSolana_bot, @BloomEVMbot), and install the extension only from the link on bloombot.app
- Keep only active trading funds in Bloom wallets, and store the private key offline, never in Telegram chats
What it can do with your money
| Who holds the keys | The service holds the keys The bot creates the wallet and gives you its private key to save ('Make sure to copy and save the private key!'), and it keeps the key so it can trade for you. The docs don't describe how Bloom stores keys. source |
|---|---|
| Can funds be sent out to any address? | Yes. Withdrawals go to an address you set. You can lock that address; unlocking starts a 24-hour cooldown before it can be changed. source |
Official links
- Website:
bloombot.app - Telegram:
@BloomSolana_bot - Telegram:
@BloomEVMbot - Telegram:
@bloomportal - X:
@BloomTrading
Where we confirmed these
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-10-26 | Bloom said an attacker exploited a remote code execution (RCE) vulnerability in a third-party module and drained 49 wallet addresses belonging to 9 users, about 9,408 SOL ($947,000). Bloom says no private keys were accessed or compromised and that it ruled out broader exposure of users' wallets; it took all systems offline as a precaution and said users must log in again when services return. | about 9,408 SOL (about $947,000) | Bloom said later the same day that 100% of the affected funds, 9,408 SOL, had been refunded to all 9 users. It has not published a detailed post-mortem. | source |
What it knows about you
| What it collects |
|
|---|---|
| What it can see | Bloom runs your trades from its Telegram bot, the Manager web app and the Chrome extension, including copy trades it executes for you, so its logs see each command and trade, tied to your Telegram ID. Bloom's wallets doc says the bot keeps your wallet's key so it can trade for you, while its privacy policy says Bloom does not store, access or recover private keys; we couldn't reconcile the two. Trades are also public on the chains Bloom trades on (Solana, Ethereum, BSC, Base and others), so anyone who knows your bot wallet's address can follow it. |
| Past data breaches | None found in the vendor's notices or reputable reporting as of 2026-10-28. That doesn't prove nothing happened. |