A hack targeting users of Bloom, a Solana trading bot that operates inside Telegram, drained about 9,408 SOL, or roughly $947,000, according to the company. Bloom said the attack affected 49 wallet addresses tied to nine users.
The company said the incident was caused by a remote code execution vulnerability in a third-party module. Bloom added that private keys were not compromised, trading has been halted, and all affected users will be repaid in full.
Attack unfolded in under two minutes
Blockchain analytics firm Bitquery said the attacker moved through the wallets in 94 seconds. Its analysis indicates the hacker first tested one wallet for each trader and then emptied the wallets in descending order by size.
Bloom counted 49 affected wallet addresses, while Bitquery reported 48 drained wallets. Bitquery estimated the total loss at about $953,000, slightly above Bloom’s figure, and said the largest single loss was 1,636 SOL, worth around $166,000.
SOL was taken while USDC was left behind
According to Bitquery’s on-chain review, the attacker removed only SOL from the compromised wallets. Around $57,000 in USDC remained untouched.
The analytics firm also said nearly all of the stolen SOL was still sitting in a single wallet controlled by the attacker at the time of its review.
Bloom says unaffected wallets are safe
In its statement, Bloom said the exploit involved a third-party component rather than users’ private keys. The company said unaffected wallets remain safe despite the breach.
Bloom also urged users to move any remaining funds to fresh wallets generated with new private keys as a precautionary step.
Trading halted as reimbursements are prepared
Hours after the drain, trading on Bloom was stopped. The company said it plans to reimburse 100% of the stolen funds directly to new wallets designated by the affected users.
Bloom said there would be no separate relief fund because the company itself would cover the losses for the nine affected users. The next confirmed step is repayment to those users through newly selected secure wallets.
Source: dailyhodl.com