Bloom Telegram bot loses $947k in SOL from nine user wallets

The stolen amount is insufficient to shift SOL's price by itself, yet it occurs amid a fragile market. In October, SOL dropped roughly 14%, the worst performance among the top four digital assets, pressured by outflows from spot Solana ETFs and a wider retreat from crypto risk. The longer-term impact could hit the Telegram bot niche, where users trade signing control for faster execution. A loss of trust in that model might reduce memecoin and short-lived trading activity, a large share of which takes place on Solana.

---

Nearly $1 million worth of users' SOL was drained from a Telegram bot within 94 seconds. The bot's operator claims the private keys remained secure, though the on-chain data requires further explanation.

Summary:

• Bloom, the Telegram trading bot, reports that approximately 9,408 SOL (worth roughly $947,000) was taken from 49 wallets linked to nine users on October 26.
• The platform blames a remote code execution vulnerability in an external module and asserts that no private keys were exposed.
• Bitquery's analysis showed that the withdrawals from 48 wallets spanned 94 seconds and each transaction carried a valid signature from the originating wallet's key.
• Several of the affected wallets had seen no activity for months, and the pattern of withdrawals suggests prior planning.
• Bloom intends to fully compensate the impacted users, has suspended certain features, and recommends transferring leftover funds to fresh wallets.
• The incident is confined to a single application rather than the Solana blockchain itself, and its scale pales compared to the $285 million Drift Protocol hack in April.

A Telegram bot named Bloom, which operates on Solana and EVM chains, stated that an attacker removed roughly 9,408 SOL (approximately $947,000) from 49 wallets belonging to nine users on October 26. The firm pledged to fully refund all impacted customers and has halted some operations as the probe continues.

This incident stems from a compromise of a single application rather than a direct assault on the Solana blockchain. According to Bloom, the attacker leveraged a remote code execution bug in an external module, permitting unauthorized code to operate within a segment of the bot's software. On-chain tracker Onchain Lens identified the transfers to one receiving address at 04:26 UTC, and initial blockchain assessments estimated the loss a bit larger, roughly $954,000.

The narrative from the company and the findings from independent tracking do not fully align. Bloom insists that no private keys were stolen and that other wallets remain secure. But blockchain analytics provider Bitquery observed that each transaction bore a valid signature from the source wallet's private key, and the entire process across 48 wallets was completed in 94 seconds. Bitquery was unable to determine how the attacker acquired this signing capability. Several of the affected wallets had been dormant for months, and the sequence of withdrawals indicates the targets were pre-selected before the attack. Until Bloom releases a root-cause analysis, the assertion that keys were not compromised should be considered the company's stance rather than a verified conclusion.

For users, this incident highlights the trade-off inherent in the convenience. Trading bots that act on behalf of users require some signing privileges; thus, any vulnerability in their code can endanger funds, even if the underlying blockchain functions correctly. Bloom has recommended that users transfer any leftover balances to new wallets with newly created keys.

By Solana's scale, the loss is minor. In April, thieves stole roughly $285 million from Drift Protocol, the biggest perpetual futures exchange on Solana, an event that TRM Labs labeled the largest DeFi exploit of 2026.

The key development to monitor is Bloom's root-cause analysis, specifically whether it clarifies how properly signed transfers occurred without key compromise. Verification that all nine users have been reimbursed would alleviate anxiety. Proof of broader key exposure would escalate this contained event into a wider issue regarding bot security. Transfers from the attacker's receiving address are also worth watching, as an indicator of whether recovery efforts might succeed.