Bloom Telegram Bot Hack: $953K Stolen From 48 Solana Wallets in 94 Seconds
Share
Key Takeaways
A hacker drained 9,408 SOL, worth approximately $953,000, from 48 wallets associated with Telegram trading bot Bloom on Oct. 26.
Blockchain investigators linked the affected wallets to nine traders and found that some had not used Bloom since early 2025.
Bloom blamed a third-party software vulnerability, denied that private keys were compromised and promised full reimbursement.
A hacker stole nearly $1 million in Solana (SOL) from users of Telegram trading bot Bloom, draining 48 wallets in just 94 seconds on Oct. 26.
The attacker transferred approximately 9,408 SOL, worth $953,000 at the time, from wallets belonging to nine traders, according to an onchain investigation by Bitquery.
The operation involved a series of small test transactions followed by rapid withdrawals, with the attacker prioritizing wallets holding the largest SOL balances.
We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.
How Hacker Drained 48 Solana Wallets in 94 Seconds
Bitquery’s investigation found that the attack began shortly before 1 a.m. UTC, when two initial transactions failed.
The attacker subsequently sent small test transfers from selected wallets to a newly created receiving address.
Investigators identified nine groups of wallets associated with nine traders. After testing one wallet from each group, the attacker began transferring their SOL balances.
The first full withdrawal occurred at approximately 1:03 a.m. UTC. The remaining 47 wallets were emptied over the following 51 seconds, completing the full-drain sequence in 94 seconds.
The attack was heavily concentrated among larger accounts.
Six wallets accounted for approximately 61% of the stolen SOL, while the median affected wallet lost around 89 SOL, worth roughly $9,000.
The largest individual wallet loss reached approximately 1,636 SOL, valued at $166,000. Notably, 24 of the 48 wallets had not traded through Bloom during the preceding month. Five had been inactive on the platform since the first half of 2025.
That finding raises concerns about the security of wallets previously connected to automated trading services, even after users stop trading through them.
Did Bloom’s Private Keys Get Compromised?
Bloom attributed the incident to a remote code execution vulnerability involving a third-party software module.
The company maintained that users’ private keys had not been accessed or compromised. However, Bitquery found that the unauthorized SOL transfers were signed using the affected wallets’ own signing keys.
There were no malicious token approvals, additional signers, or smart contract interactions involved in the withdrawals.
The findings indicate that the attacker gained the ability to authorize transactions from the affected wallets, but they do not establish whether private keys were extracted.
A vulnerability in software with access to wallet-signing functions could potentially allow unauthorized transactions without exposing the underlying keys.
Bloom has not publicly provided a complete technical explanation reconciling its findings with the onchain evidence.
Hacker Leaves $57K in USDC Behind as Bloom Promises Refunds
The attacker focused on SOL rather than draining every available asset.
Bitquery identified approximately $56,853 in USDC remaining across the affected wallets immediately after the withdrawals.
One wallet held roughly $49,041 in USDC. The attacker attempted to access those funds, but the owner transferred them elsewhere before the attempt succeeded.
The stolen SOL was subsequently consolidated into another wallet holding approximately 9,408.21 SOL.
As of Bitquery’s final observation on Oct. 26, that wallet had not transferred the funds to an exchange, bridge, or mixer. Its present balance may have changed since then.
Bloom said it would reimburse affected traders directly, using newly created wallets rather than relying on community donations.
There won't be any need for a relief fund. Bloom will fully reimburse all funds lost by the 9 affected wallets, directly to new, secure wallets designated by their respective owners.
We're still actively investigating the root cause, including whether a third-party provider may…
The company also suspended trading activity while investigating the vulnerability. The incident adds to security concerns surrounding Telegram trading bots, which frequently require access to wallet-signing capabilities to execute transactions automatically.
For users, the case highlights a risk that extends beyond active trading. Wallets previously used with automated services may remain vulnerable if their signing credentials or associated infrastructure are compromised.
Bloom’s next disclosures will be critical in establishing the cause of the breach, confirming reimbursements, and explaining what safeguards will prevent similar attacks.
Disclaimer:
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
