Key facts
- Hackers drained $953,000 from 48 wallets in 94 seconds.
- Bloom will reimburse all affected traders.
- The attack exploited a vulnerability in a third-party module.
- No private keys were accessed or compromised, Bloom said.
Hackers stole $953,000 from 48 cryptocurrency wallets linked to the Telegram trading bot Bloom in under two minutes, according to blockchain analytics company Bitquery. The attack drained funds in 94 seconds, with each drain being a Solana transfer signed with the affected wallet’s private key. Bloom has pledged to reimburse all affected traders in full, attributing the incident to a remote code execution vulnerability in a third-party module. The company stated that no private keys were accessed or compromised. Trading bots like Bloom hold users' private keys to facilitate trades, which can pose lingering security risks even after users stop using the service. Some wallets drained in the attack had been inactive on the bot since the first half of 2025.