Attackers drained $953,000 from 48 cryptocurrency wallets connected to Telegram trading bot Bloom in 94 seconds, blockchain analytics firm Bitquery reported on Monday.
Nine traders who had used the bot lost funds in the incident. Bitquery confirmed that every withdrawal was a Solana transfer authenticated using the victim wallet's private key.
Bloom committed to full reimbursement for all nine affected users. The platform later issued a statement attributing the breach to a remote code execution flaw in a third-party module, insisting that no private keys had been accessed or compromised.
Because trading bots like Bloom retain custody of users' private keys to execute trades automatically, security vulnerabilities can persist long after a trader has stopped using the service. Bitquery noted that five of the drained wallets had not interacted with the bot since the first half of 2025.
Telegram trading bot exploits have become a recurring problem. In September 2024, eleven Banana Gun users lost approximately $3 million. A year earlier, in October 2023, exploits targeting the router contracts of Maestro and Unibot resulted in combined losses of $1.1 million for their users.
Source: cointelegraph.com