Attackers drain about 9,400 SOL, close to $1 million, from 49 BloomTrading bot wallets as the Telegram trading bot promises full refunds

Users of BloomTrading, a trading bot that runs inside Telegram on Solana and other chains, have lost close to $1 million after their wallets were emptied, and the team says it will pay them back.

The blockchain monitoring account Onchain Lens linked about 9,408 SOL, roughly $954,000 at the time, to a single receiving address, with transfers from 49 suspected victims, crypto.news reported on Monday. The largest single loss was 1,636 SOL, about $166,000. Because the tracing covers one receiving address, the final total could be higher. Some users said USDC in the same wallets was left alone.

In a statement on Monday, BloomTrading said it would fully compensate the affected wallets by sending replacement funds to new addresses chosen by their owners, and would not use a community relief fund. "We're still actively investigating the root cause," it said, naming a possible third-party compromise as one line of inquiry. Crypto Briefing reported that the bot temporarily disabled certain functions.

Accounts of the cause differ. crypto.news said the statement covered nine wallets and did not explain the gap with the 49 traced. Decrypt reported that the 49 wallets belonged to nine users, that the attackers used a third-party module to run code remotely, and that Bloom says no private keys were compromised. Bloom creates and holds users' keys, Crypto Briefing noted, and crypto.news advised users whose keys may be exposed to move what is left to wallets with newly generated keys.