What happened
Attackers emptied a cluster of Solana wallets controlled by BloomTrading, a bot-trading service, moving around 9,400 SOL out in a sequence of transfers that on-chain observers flagged as coordinated. CryptoSlate first reported the drain on Friday, citing signature data that resolved to the owner key tied to BloomTrading's bot infrastructure. BloomTrading's @BloomTrading account denied that a private key had been compromised, saying the incident does not match a signer-leak pattern and that the service-control layer is where the investigation is focused.
Some of the drained wallets were among the project's oldest bot addresses, including ones that had been idle for an extended stretch. That matters because dormant wallets rarely sign on their own. If an owner key signed for addresses that hadn't moved coins in months, the compromise is upstream of any single wallet.
Public mempool and transfer data cited in the CryptoSlate report point to a single actor, not a scrape by multiple parties racing to the same leaked seed.
Why it matters
The drain is small in dollar terms next to the broader Solana float, but the mechanism is the story. Bot-trading services on Solana sit on top of thousands of program-controlled wallets and signer flows, and most of them delegate signing to a central service rather than to each end user. If an attacker can pull owner-key signatures without stealing the key itself, by abusing a signing endpoint, a cached session, or a misconfigured service, every operator running a similar architecture has to assume they're exposed too.