Bloom trading bot hackers drain $953K from nine wallets in 94 seconds

Hackers empty nine trading bot wallets in under two minutes

Attackers drained $953,000 from 48 cryptocurrency wallets tied to the Telegram trading bot Bloom in just 94 seconds, blockchain analytics firm Bitquery reported Monday.

Blockchain is the public ledger that records all transactions on a crypto network. A wallet is a digital account that holds your crypto assets and lets you send and receive them.

The wallets belonged to nine traders who had used Bloom. Each stolen transfer was a Solana (SOL) payment signed using the wallet's own private key.

What Bloom said about the breach

In a statement, Bloom blamed the attack on a remote code execution flaw in a third-party module and said no private keys were accessed or compromised. The company pledged to reimburse all affected traders in full.

A remote code execution flaw is a software bug that lets an attacker run malicious code on a system as if they were the owner.

Private keys are secret codes that control access to crypto in a wallet. They are usually kept safe by the person who owns the wallet.

Even inactive wallets were drained

Five of the drained wallets had not been used on the Bloom bot since the first half of 2025, according to Bitquery. Trading bots like Bloom hold users' private keys to trade on their behalf, which can leave lingering security risks even after users stop using them.

Telegram bot hacks are becoming more common

This is not the first time Telegram trading bot users have lost money. In September 2024, 11 Banana Gun users lost about $3 million. In October 2023, users of Maestro and Unibot trading bots lost a combined $1.1 million to exploits of their router contracts.

What is confirmed

• Bitquery confirmed $953,000 was drained from 48 wallets in 94 seconds.


• The wallets belonged to nine Bloom traders.


• The stolen funds were sent via Solana transfers signed with each wallet's private key.


• Five wallets had been inactive on Bloom since early 2025.


• Bloom said the cause was a remote code execution flaw in a third-party module.


• Bloom said no private keys were accessed or compromised and will reimburse all affected traders in full.

What is still unclear

• Bitquery says transfers were signed with private keys, while Bloom says no keys were compromised. The sources do not fully explain how the two statements fit together.


• It is not clear from the report how the third-party module flaw led to the transfers.


• The report gives no timeline for when reimbursed traders will be repaid.

Why this matters for crypto users

When you use a trading bot, you often give the bot access to your crypto so it can execute trades for you. That arrangement can leave funds at risk even after you stop using the bot, since the bot may still hold the keys needed to move the money.

Sources

• Cointelegraph


• Bitquery investigation


• Bloom Trading statement