Bloom pledged to reimburse nine traders after $953,000 was drained from 48 wallets, saying no private keys were accessed or compromised.

Hackers stole nearly $1 million from wallets linked to Telegram trading bot Bloom in under two minutes, according to blockchain analytics company Bitquery.

The attack drained $953,000 in 94 seconds from 48 cryptocurrency wallets belonging to nine traders who had used the bot, Bitquery reported Monday.

Bitquery said each drain was a Solana (SOL) transfer signed with the affected wallet’s private key.

Bloom pledged to reimburse all affected traders in full. In a later Monday statement, it attributed the attack to a remote code execution vulnerability in a third-party module and said no private keys had been accessed or compromised.

Trading bots such as Bloom hold users’ private keys to trade on their behalf, which can leave lingering security risks even after traders stop using them. Five wallets drained in the Bloom attack had been inactive on the bot since the first half of 2025, Bitquery said.

This is not the first time Telegram trading bot users have lost funds in an attack. In September 2024, Banana Gun reported that 11 users lost about $3 million. In October 2023, users of Telegram trading bots Maestro and Unibot lost a combined $1.1 million to exploits of their router contracts.

Related: Cysic dangles a 10% bounty, hacker pours loot into Tornado Cash