Telegram’s Bloom Bot Hack Drains $953K From 48 Wallets

Hackers drained $953,000 from 48 cryptocurrency wallets linked to nine traders using the Telegram trading bot Bloom, according to blockchain analytics firm Bitquery. The attack transferred the funds across Solana in just 94 seconds. Each transaction was signed with the affected wallet’s private key, Bitquery reported.

Bloom pledged to reimburse all affected traders in full. In a statement on Monday, the bot attributed the incident to a remote code execution vulnerability in a third-party module and said no private keys had been accessed or compromised. Five of the drained wallets had not been active on Bloom since the first half of 2025.

Trading bots such as Bloom retain users’ private keys to execute trades, creating security risks that can persist even after users stop relying on the service. The Bloom incident follows other Telegram bot exploits: Banana Gun reportedly lost about $3 million from 11 users in September 2024, while Maestro and Unibot users lost a combined $1.1 million through router-contract exploits in October 2023.