Hackers Drain $953,000 From Bloom Telegram Trading Bot Wallets in 94 Seconds
Key Takeaways
- •Attackers stole $953,000 from 48 Solana wallets belonging to nine Bloom trading bot users in a 94-second drain, according to Bitquery.
- •Bloom pledged to fully reimburse all affected traders and attributed the attack to a remote code execution vulnerability in a third-party module, while stating no private keys were compromised.
- •Five of the drained wallets had been inactive on the bot since the first half of 2025, showing that security exposure can persist for users who stopped actively using the service.
- •Telegram trading bots have suffered repeated exploits, including a roughly $3 million loss for 11 Banana Gun users in September 2024 and $1.1 million in combined losses for Maestro and Unibot users in October 2023.
- •Unlike earlier router contract exploits, the Bloom incident involved a third-party module, highlighting that bot security extends beyond on-chain code.
Hackers stole $953,000 from wallets linked to the Telegram trading bot Bloom in under two minutes, according to blockchain analytics firm Bitquery, and the platform has pledged to fully reimburse the nine traders affected.
Bitquery reported Monday that the attack drained $953,000 in 94 seconds from 48 cryptocurrency wallets belonging to nine traders who had used the bot. Each drain was a Solana (SOL) transfer signed with the affected wallet's private key, the firm said.
Bloom blames third-party vulnerability
Bloom committed to reimbursing all affected traders in full. In a statement posted on X later Monday, the platform attributed the attack to a remote code execution vulnerability in a third-party module and said no private keys had been accessed or compromised.
Remote code execution is among the more serious classes of software flaws, since it allows an attacker to run arbitrary code on a targeted system. Further technical details of the exploit were not included in the statement.
Custody model leaves lingering risks
Trading bots such as Bloom operate inside Telegram, where users place trades through chat commands; to execute them, the bots hold users' private keys on their behalf — an arrangement that can leave security risks lingering even after traders stop using the service. Bitquery noted that five of the wallets drained in the attack had been inactive on the bot since the first half of 2025, meaning exposure extended to accounts whose owners had long stopped actively using the bot.
Repeat pattern for Telegram trading bots
The incident is not the first time Telegram trading bot users have lost funds in an attack. In September 2024, Banana Gun reported that 11 users lost about $3 million. In October 2023, users of the Telegram trading bots Maestro and Unibot lost a combined $1.1 million to exploits of their router contracts.
The Bloom incident, by contrast, points to a third-party module rather than a router contract, underlining that bot security spans more than just on-chain code. Attention now turns to how Bloom carries out its reimbursement pledge and what further detail emerges about the module involved.
Related: Cysic dangles a 10% bounty, hacker pours loot into Tornado Cash
Source: Cointelegraph
