A hacker drained nearly $1 million worth of Solana from users of a crypto trading bot that operates inside Telegram, according to Bloom, the company behind the bot.
Bloom said the attack affected 49 wallet addresses belonging to nine users and took about 9,408 SOL, valued at roughly $947,000. The attacker exploited a third-party module through a remote code execution vulnerability, the company said.
“No private keys were compromised, unaffected wallets are safe, and all affected users will be fully reimbursed by Bloom,” Bloom said.
On-chain account
Blockchain analytics firm Bitquery reported that the attacker tested one wallet per trader before emptying each trader’s wallets, starting with the largest, all within 94 seconds.
Bitquery counted 48 drained wallets and estimated the loss at about $953,000. The largest single loss was 1,636 SOL, or about $166,000, according to the analytics firm.
The attacker took only SOL and left behind about $57,000 in USDC. Almost all of the stolen SOL remained unmoved in a single wallet controlled by the attacker.
Trading halted and reimbursement planned
Trading on Bloom stopped hours after the drain. The company said it will repay 100% of the stolen funds directly to new wallets chosen by the affected users.
“There won’t be any need for a relief fund. Bloom will fully reimburse all funds lost by the 9 affected wallets, directly to new, secure wallets designated by their respective owners,” Bloom said.
The company added that user safety remains its top priority and recommended that users move remaining funds to fresh wallets with newly generated private keys.
