Telegram Trading Bot Bloom Hacked: $953K Drained From 48 Wallets in 94 Seconds
Bitquery says each outgoing transfer was a SOL transaction signed with the private key of an affected wallet; Bloom has promised full reimbursement and blames a third-party module's remote code execution flaw.
$953K Drained in 94 Seconds
According to blockchain analytics firm Bitquery on October 27, 2026, 48 wallets linked to the Telegram trading bot Bloom were drained of approximately $953,000 within 94 seconds, affecting nine traders. Bitquery said each outgoing transfer was a SOL transaction signed with the private key of an affected wallet.
Bloom pledged same-day to fully reimburse affected users and attributed the attack to a remote code execution vulnerability in a third-party module, saying private keys were neither accessed nor leaked. Bitquery data shows that five of the emptied wallets had not used the bot since the first half of 2025.
Dormant Wallets Still Exposed
Such bots must custody users' private keys in order to trade on their behalf, meaning keys may remain in the system even after a user stops using the service. Telegram trading bots have suffered repeated similar incidents: in September 2024, Banana Gun reported that 11 users lost about $3 million; in October 2023, routing contracts at Maestro and Unibot were exploited, with users losing a combined $1.1 million.
Source: https://cointelegraph.com/news/bloom-bot-hackers-953k-faster-popcorn?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound
Provenance & status
- Byline
- OceanAlt Editorial
- First published
- 2026-10-27
- Last updated
- 2026-10-27
- Content type
- Newsflash
- Source material
- View original ↗
Related reading
Harbor Enters AI Agent Insurance With $10M Seed Round, Leaving Liability Attribution and Claims Pricing as the First Unsolved Problems
South Korea's President Confirms AI Role in Attacks on Seven Financial Firms: A Look at the Attack Chain
NVIDIA Open-Sources Agent Security Platform: Another Piece in the Agent Security Infrastructure, from Testing to Deployment
Paste a payee address before you pay and see whether it's on a sanctions list, through a mixer, or tagged for fraud.
This judgement can sit inside your own product
One line of code; it touches neither your CSS nor your JS. The same pre-settlement judgement can appear in your articles, on your wallet's confirmation screen, or as an endpoint your agent calls before it pays.