Bloom trading bot users lose $953K in 94-second wallet drain

Attackers drained about $953,000 from wallets tied to the Telegram trading bot Bloom in just 94 seconds, Bitquery reported on Monday. Blockchain analytics firm Bitquery counted 48 wallets belonging to nine traders, Cointelegraph reports. Bloom says it will reimburse all affected users in full.

What happened

• Each theft was a Solana (SOL) transfer signed with the wallet's own private key, according to Bitquery, so the attacker was able to sign as the users.
• In a later statement Bloom attributed the attack to a remote code execution vulnerability in a third-party module and said no private keys had been accessed or compromised. It has not published a full post-mortem yet.
• Five of the drained wallets had been inactive on the bot since the first half of 2025.

The two accounts are hard to square for now: a transfer signed with a wallet's key normally means something that could use that key was compromised, even if the key itself was never copied out. A detailed incident report should clarify which.

Why trading bots are risky

Telegram bots such as Bloom are popular for sniping new tokens and meme coins on Solana because they trade in seconds. To do that, the bot holds or controls your private keys on its own servers. That makes it a custodial service in practice, with all the risks explained in our guide to custodial vs non-custodial wallets, and the risk does not disappear when you stop using the bot, as the dormant wallets here show.

This is not the first such incident. In September 2024, Banana Gun said 11 users lost about $3 million, and in October 2023 users of Maestro and Unibot lost a combined $1.1 million through exploits of the bots' router contracts.

What bot users should do

• Withdraw funds you are not actively trading to a wallet only you control.
• Empty and abandon old bot wallets you no longer use; do not leave dust or tokens behind.
• Treat any bot balance as hot money, and keep long-term holdings in cold storage.