Hackers drained 9,408 SOL, about $953,000, from 48 wallets tied to Bloom, a Telegram trading bot for Solana, in 94 seconds, according to a report published Oct. 27 by blockchain analytics firm Bitquery.
The attack hit wallets belonging to nine traders, Bitquery said, after attackers made several small test transfers before emptying the accounts. Of the 48 wallets, 24 had not traded through Bloom in the past month, and five had been inactive since early 2025; about $57,000 in USDC was left untouched.
Bloom said the breach exploited “a remote code execution vulnerability in a third-party module” and said “no private keys had been accessed or compromised.”
Bitquery disputed that account, saying every outgoing transfer was signed with the wallet's own key, “without a token approval, smart contract or additional signer.” Bloom has not explained how a third-party module flaw could have produced that result without access to the keys.
The company has not disclosed a refund timeline or how attackers accessed wallets dormant for nearly a year and a half. Bloom pledged to fully reimburse affected users, move remaining funds to new secured wallets at its expense, and said it is checking whether an external service provider was breached.
It is not the first breach of a Solana trading bot on Telegram, though Bitquery's report does not detail the earlier cases.
