Telegram Trading Bot Bloom Hit by a 94 Second Wallet Drain Worth Nearly $1 Million

Within a window of just over a minute and a half, an attacker pulled $953,000 out of 48 wallets tied to Bloom, a trading bot that runs inside Telegram. According to its findings, every drain was a Solana transfer that carried a valid signature from the private key of the wallet being emptied, which suggests the thief was able to act with the same authority as each owner.

Bloom Response and Reimbursement Plan

Bloom has promised to repay all nine traders in full. Later on Monday, the team blamed a remote code execution weakness in a third party module and insisted that no private keys were accessed or compromised, a claim that sits uneasily beside Bitquery’s finding that the transfers were signed with those keys.

Why Telegram Trading Bots Carry Wallet Security Risks

Bots of this kind store users’ private keys so they can place trades automatically, and that design can leave danger behind even after a person stops using the service. Five of the drained wallets had not touched the bot since the first half of 2025, yet they were still emptied.