Blockchain analytics firm Bitquery reported that hackers stole $953,000 from 48 cryptocurrency wallets linked to the Telegram trading bot Bloom in just 94 seconds. The attack targeted nine traders who had used the bot, with each drain executed as a Solana (SOL) transfer signed using the affected wallet’s private key.
Bloom pledged to reimburse all affected users in full. In a statement issued Monday, the company attributed the breach to a remote code execution vulnerability within a third-party module. Bloom asserted that no private keys were accessed or compromised during the incident. However, Bitquery noted that five of the drained wallets had been inactive on the bot since the first half of 2025, highlighting persistent security risks associated with bots that retain user credentials.
This incident follows a pattern of losses for Telegram trading bot users. In September 2024, Banana Gun reported that 11 users lost approximately $3 million. Earlier, in October 2023, users of Maestro and Unibot suffered combined losses of $1.1 million due to exploits targeting their router contracts.
The rapid extraction of nearly $1 million from Bloom users underscores the inherent fragility of custodial-like arrangements in decentralized finance tools. While Bloom claims its own infrastructure remained secure by pointing to a third-party module vulnerability, the fact that attackers successfully signed transactions with private keys suggests a critical failure in how those keys were stored or managed. The involvement of wallets inactive since early 2025 indicates that the risk surface extends far beyond active usage, challenging the notion that disengaging from a service eliminates exposure.
From an Operational Risk perspective, this event highlights the systemic danger of centralized key management in ostensibly decentralized ecosystems. Trading bots require private keys to execute trades, creating single points of failure that attract sophisticated attacks. The recurrence of similar incidents involving Banana Gun, Maestro, and Unibot demonstrates that these vulnerabilities are not isolated anomalies but structural weaknesses common to the sector. Users must recognize that reimbursement pledges, while helpful, do not mitigate the underlying architectural risks of entrusting private keys to third-party intermediaries.
