Hackers Swipe Nearly $1 Million from Telegram Trading Bot Wallets in Under Two Minutes

The breach occurred over 94 seconds, during which $953,000 was drained from 48 crypto wallets owned by nine traders who had been using the Bloom bot, Bitquery revealed in their Monday report.

Each theft involved transfers executed on the Solana (SOL) network, authorized using the private keys of the compromised wallets, Bitquery explained.

In response, Bloom promised to fully compensate all affected users. The company later attributed the incident to a remote code execution vulnerability found in a third-party module, emphasizing that no private keys were exposed or stolen during the attack.

Trading bots like Bloom store users’ private keys to carry out trades on their behalf, a practice that can maintain security vulnerabilities even after traders stop using the service. Bitquery noted that five of the hacked wallets had been inactive on the Bloom bot since early 2025.

This incident is not isolated; Telegram trading bot users have previously suffered losses in similar attacks. For instance, in September 2024, Banana Gun reported about $3 million lost by 11 users, while in October 2023, users of the Maestro and Unibot bots lost a total of $1.1 million due to vulnerabilities in router contracts.

This breach highlights the ongoing security risks associated with trading bots that retain private keys, underlining the importance of strengthened safeguards for users’ digital assets.