A malicious security breach has struck the Solana (SOL) ecosystem, resulting in the theft of nearly $1 million from users of Bloom, a prominent cryptocurrency trading bot operating within the Telegram chat application. The incident underscores ongoing security challenges associated with decentralized finance tools integrated into popular messaging platforms, raising renewed concerns about third-party module vulnerabilities in automated crypto trading environments.
According to official statements from Bloom, the cyberattack compromised 49 distinct wallet addresses belonging to a total of nine individual users. The unauthorized extraction netted approximately 9,408 Solana tokens, translating to an estimated financial loss of roughly $947,000 at the time of the incident. The firm behind the bot quickly identified the vector of the attack, attributing the breach to an exploitation of a third-party module that suffered from a remote code execution vulnerability.
Despite the severity of the security lapse and the substantial financial damages incurred, Bloom’s leadership team has moved swiftly to reassure the broader digital asset community regarding the nature of the breach. In public statements released following the attack, the company clarified that core security architectures remained intact. Bloom explicitly stated that no private keys were compromised during the incident, that unaffected wallets running on the platform remain safe and secure, and that all users who suffered losses will be fully reimbursed by the company.
Detailed on-chain data compiled and analyzed by blockchain intelligence firm Bitquery provides a granular look into the speed and precision of the exploit. According to Bitquery’s independent investigation into the Bloom trading bot hack, the malicious actor executed the draining process with remarkable efficiency. The attacker reportedly tested a single wallet for each targeted trader before systematically emptying all of the trader’s associated wallets, prioritizing the largest balances first. The entire sequence of unauthorized transfers was completed in just 94 seconds.
Bitquery’s telemetry slightly adjusts the metrics of the breach, tracking 48 drained wallets and calculating total losses at approximately $953,000. Within this dataset, the single largest individual loss recorded a staggering 1,636 SOL, valued at roughly $166,000. Notably, the perpetrator demonstrated selective targeting during the asset extraction. The hacker exclusively stole Solana native tokens while intentionally leaving behind approximately $57,000 worth of USD Coin (USDC) in the affected accounts.
Further tracking of the stolen capital reveals that the vast majority of the illicitly acquired Solana remains untouched. On-chain records indicate that almost all of the stolen SOL sits dormant and unmoved within a single, centralized wallet address controlled directly by the attacker. Law enforcement and blockchain forensic analysts continue to monitor the address for any potential mixing or laundering attempts.
In response to the security breach, operational safety protocols were activated immediately. Trading functionalities on the Bloom platform were suspended mere hours after the drain was detected and verified. Demonstrating accountability, the company announced a comprehensive restitution plan designed to make victims whole without the implementation of a crowdsourced relief fund or complex insurance mechanisms. Bloom confirmed that it will independently repay 100% of the stolen funds directly to new, secure wallets explicitly chosen and designated by the affected users.
Elaborating on the compensation process and future security measures, Bloom emphasized that victims will experience a direct and unhindered recovery of their assets. Company representatives reiterated that there is no need for external relief campaigns or community donations, as Bloom is shouldering the entire financial burden of the reimbursement. The company confirmed that all funds lost across the nine affected accounts will be transferred directly to newly generated wallets established by the respective owners.
As the cryptocurrency industry continues to grapple with sophisticated exploits targeting automated trading interfaces, platform developers are urging users to exercise heightened caution. Bloom has strongly advised its user base to take proactive security measures by moving any remaining funds to fresh wallets equipped with newly generated private keys, reinforcing the principle that user safety remains the paramount priority for the protocol as it works to remediate the fallout from the attack.
Comments (0)