Nearly $1 million was drained from cryptocurrency wallets linked to the Bloom Telegram trading bot in less than two minutes, highlighting the security risks of services that hold users’ private keys to execute trades.
Attack affected nine traders
Blockchain analytics company Bitquery said the incident removed $953,000 from 48 wallets in 94 seconds. The wallets belonged to nine traders who had used Bloom, a Telegram-based trading bot.
The stolen assets were transferred on the Solana blockchain. Bitquery said every drain was a Solana (SOL) transaction signed with the private key associated with the affected wallet.
Bloom said it would reimburse all nine traders in full. In a statement issued later on Monday, the service attributed the incident to a remote code execution vulnerability in a module supplied by a third party. It also said that no private keys had been accessed or compromised.
Remote code execution vulnerabilities can allow an attacker to run unauthorized commands through vulnerable software. In this case, Bloom’s explanation points to a weakness in an external component used by the service, while the blockchain transactions showed that funds were authorized from the affected wallets.
Why private-key access matters
Trading bots connected to Telegram can place transactions for users without requiring them to approve every trade manually. To do that, services such as Bloom hold or use users’ private keys—the credentials needed to authorize cryptocurrency transfers.
That arrangement can create continuing exposure even after a trader stops actively using a bot. Bitquery said five of the wallets drained in the Bloom incident had not been active on the bot since the first half of 2025.
Bloom’s reimbursement pledge limits the direct reported loss for the affected traders, but the incident raises broader questions about how long wallet access remains in place and how third-party software is secured. According to Cointelegraph, the episode is also part of a wider pattern of attacks affecting Telegram trading-bot users.
In September 2024, Banana Gun said 11 users lost about $3 million. A year earlier, users of the Maestro and Unibot Telegram bots lost a combined $1.1 million in exploits involving their router contracts.
Moneyiar market picture
Moneyiar market data recorded on October 25, 2026, showed mixed performance among the listed digital assets:
- Cronos (CRO): $0.054290275, down 1.83% over 24 hours and 3.03% over seven days.
- Aster (ASTER): $0.7032517179, down 0.1% over 24 hours and up 1.27% over seven days.
- Compound (COMP): $21.1287447338, down 10.42% over 24 hours and up 0.3% over seven days.
- edgeX (EDGE): $0.3244313833, up 0.81% over 24 hours and 13.63% over seven days.
These figures are Moneyiar data, with timestamps ranging from 22:38 to 22:39 on October 25, 2026, and do not measure the specific impact of the Bloom incident.
