Bloom Telegram bot users lose $953K in Solana wallet drain
Bitquery says hackers drained about $953,000 in 94 seconds from 48 wallets tied to nine users of Telegram trading bot Bloom. Bloom blames a remote code execution flaw in a third-party module, says no private keys were compromised and pledges 100% reimbursement.
Hackers drained about $953,000 in 94 seconds from 48 wallets belonging to nine traders who used the Telegram trading bot Bloom, according to blockchain data provider Bitquery, which reported the October 26 attack on Monday.
Bitquery said each drain was a Solana (SOL) transfer signed with the affected wallet's private key. Five of the drained wallets had been inactive on the bot since the first half of 2025.
Bloom pledged to reimburse all affected traders in full. In a later Monday statement, it attributed the attack to a remote code execution vulnerability in a third-party module and said no private keys were accessed or compromised.
"Bloom will fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users."
Bloom Trading
Tallies of the damage differ slightly. Bloom later said 49 addresses were affected, belonging to the same nine users. Separate figures put the drain at 9,408 SOL, about $954,000, with the largest single wallet loss at 1,636 SOL, about $166,000. Other reports cite $947,000. Bitquery's count stands at 48 wallets and $953,000.
Bloom has begun tracing the stolen assets and is weighing recovery options that may involve fund freezes. It had not said when reimbursements would be completed. The company also said wallets not affected by the attack remain safe.
Bloom's account leaves one tension unresolved. The company says no private keys were compromised, yet Bitquery found each transfer was signed with the affected wallet's private key.
Trading bots hold users' keys to trade on their behalf, which can leave lingering security risks even after traders stop using them. The five dormant wallets drained in this attack illustrate that risk.
The incident is not the first loss for Telegram trading bot users. In September 2024, Banana Gun reported that 11 users lost about $3 million. In October 2023, users of Maestro and Unibot lost a combined $1.1 million to exploits of their router contracts. At roughly $953,000 across nine users, the Bloom drain is smaller than the Banana Gun case.
