Hackers exploited a vulnerability in the Telegram trading bot Bloom, draining $953,000 from 48 wallets in just 94 seconds. The attack targeted nine traders who had used the bot, according to blockchain analytics firm Bitquery. Each transaction involved a Solana (SOL) transfer signed with the affected wallet’s private key, though Bloom assured users that no private keys were accessed or compromised.
Bloom has pledged to reimburse all affected traders in full. The company attributed the breach to a remote code execution vulnerability in a third-party module. The incident highlights lingering security risks for trading bots that hold users’ private keys, even after traders stop using them. Bitquery noted that five of the drained wallets had been inactive on the bot since the first half of 2025.
This is not the first time Telegram trading bots have faced such attacks. In September 2024, Banana Gun reported that 11 users lost about $3 million. Earlier, in October 2023, users of Maestro and Unibot lost a combined $1.1 million due to exploits of their router contracts.