Cryptoupdated 30m ago2 min read
Bloom Telegram Solana Trading Bot Hackers Drain $953,000 From 48 Wallets In 94 Seconds
8outlets comparedWhere the coverage agrees
4 Western Alternative3 Other1 AsianThis article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Attack drained about 9,408 SOL, roughly $953k–$954k, from 49 wallets of nine users. Hack completed in 94 seconds, under two minutes.
8 outlets told this the same way.
Bloom drain in 94 seconds
Bloom Trading said a Telegram-based Solana trading bot was hacked and that an attacker drained $953,000 in 94 seconds from 48 cryptocurrency wallets belonging to nine traders who had used the bot. Bitquery said each drain was a Solana (SOL) transfer signed with the affected wallet’s private key, and Bloom later attributed the attack to a remote code execution vulnerability in a third-party module.
Bloom pledged to reimburse all affected traders in full, and Bitquery said five of the wallets drained had been inactive on the bot since the first half of 2025. Onchain Lens warned that the hacker withdrew 9,408 SOL from 49 victim wallets, and Bloom later clarified that the 49 wallets actually belonged to 9 users.
Keys, signatures, and dispute
Bloom insisted in a later Monday statement that no private keys had been accessed or compromised, even as Bitquery reported that each drain was a Solana (SOL) transfer signed with the affected wallet’s private key. Bitcoin News quoted Bloom’s position that "No private keys were compromised, unaffected wallets are safe, and all affected users will be fully reimbursed by Bloom."
InvestingLive said Bitquery’s data showed that each transfer was validly signed by the origin wallet’s own key, while Bloom’s claim that private keys were not compromised remained the company’s position rather than a confirmed finding. Bloom also told users it was temporarily suspending some services as a precaution, and the team’s X account said: "All Bloom systems are currently offline as a precautionary security measure."
Reimbursement and what’s next
Bloom said it would fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users, and it also said it would compensate victims without setting up a separate relief fund. Bloom’s official channels said it was "currently investigating the matter and all remaining wallets are safe," and it added that it had "temporarily suspended some services as a precaution and will restore normal operations as quickly as possible."
“Bloom will fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users.”
Bitquery’s tracing reported that the withdrawal across 48 wallets took 94 seconds, and the same reporting said the attacker consolidated stolen funds into a single receiving address. The incident also revived attention to earlier Telegram bot losses, including Banana Gun’s September 2024 report that 11 users lost about $3 million and Cointelegraph’s mention that Maestro and Unibot users lost a combined $1.1 million in October 2023.