The theft is too small to move SOL on its own, but it lands on a fragile tape. SOL has fallen about 14% in October, the weakest of the four largest cryptocurrencies, as spot Solana ETF outflows and a broad pullback from crypto risk weigh on sentiment. The more lasting effect may be on the Telegram trading bot segment, where users give up some control of signing in exchange for speed. If confidence in that model weakens, memecoin and short-term trading activity could ease, and much of that activity runs on Solana.
—
A Telegram bot lost nearly $1 million of its users’ SOL in 94 seconds. It says the keys were safe, but the blockchain’s evidence still needs explaining.
Summary:
- Bloom, a Telegram trading bot, says about 9,408 SOL (around $947,000) was drained from 49 wallets belonging to nine users on 26 October
- Bloom attributes the breach to a remote code execution flaw in a third-party module and says no private keys were compromised
- Bitquery’s tracing found the drain across 48 wallets took 94 seconds and that every transfer was validly signed by the source wallet’s own key
- Some drained wallets had been inactive for months, and the withdrawals appear to have been organised in advance
- Bloom will reimburse affected users in full, has paused some services, and advises moving remaining funds to new wallets
- The breach is limited to one application, not the Solana network, and is small next to April’s $285 million Drift Protocol exploit
Bloom, a Telegram-based trading bot that supports Solana and EVM networks, says an attacker drained about 9,408 SOL, worth roughly $947,000, from 49 wallets belonging to nine users on Monday, 26 October. The company has promised to reimburse every affected user in full and has paused some services while it investigates.
The theft is a breach of a single application, not an attack on the Solana network itself. Bloom says the attacker exploited a remote code execution vulnerability in a third-party module, meaning a flaw that allowed outside code to run inside part of the bot’s software. On-chain monitoring service Onchain Lens flagged the outflows to a single receiving address at 04:26 UTC, and early blockchain estimates put the loss slightly higher, at about $954,000.
The company’s account and the independent tracing do not yet line up. Bloom says no private keys were compromised and that unaffected wallets are safe. However, blockchain data firm Bitquery found that every transfer was validly signed by the source wallet’s own key, and that the full sequence across 48 wallets took just 94 seconds. Bitquery could not establish how the attacker obtained that signing authority. Some of the drained wallets had been inactive for months, and the order of the withdrawals suggests the targets were organised before the attack began. Until Bloom publishes a root cause, the claim that keys were not exposed should be read as the company’s position rather than a confirmed finding.
For users, the episode shows the trade-off behind the convenience. Bots that trade on a user’s behalf need some form of signing access, so a weakness anywhere in their software can put funds at risk, even when the underlying blockchain works as designed. Bloom itself has advised users to move remaining funds to new wallets with freshly generated keys.
The loss is small by Solana standards. In April, attackers took about $285 million from Drift Protocol, the network’s largest perpetual futures exchange, in what TRM Labs called the biggest DeFi hack of 2026.
The next thing to watch is Bloom’s root-cause report, and in particular whether it explains how validly signed transfers were possible without key exposure. Confirmation that reimbursements have reached all nine users would ease concern. Evidence of wider key exposure would turn a contained incident into a broader question about bot security. Any movement of funds from the receiving address is also worth monitoring, as a sign of whether recovery remains realistic.
This article was written by Eamonn Sheridan at investinglive.com.