Solana

Drift

Daily

A hacker reportedly drained nearly $1,000,000 in SOL from Solana trading bot users in just 94 seconds, according to reporting from the Daily Hodl. The speed of the alleged theft, less than two minutes to empty close to seven figures, signals the kind of automated, precision attack that trading bot infrastructure is uniquely vulnerable to.
<h2 id="what-happened-in-the-reported-94-second-sol-drain">What Happened in the Reported 94-Second SOL Drain</h2>
The reported incident centers on users of a Solana-based trading bot, with nearly $1 million in SOL allegedly swept out in a single, rapid-fire sequence. Ninety-four seconds. That is the window between the first unauthorized transfer and the last. For related coverage, see <a href="https://www.theccpress.com/buy-crypto-xrp-all-time-high-solana-etf-launch/" rel="noopener noreferrer nofollow">Buy Crypto: XRP Near ATH as Solana ETF Launches</a>.
The timeline alone tells you this was not a manual theft. No human can execute that kind of multi-wallet drain that quickly without automated tooling working in their favor. For related coverage, see <a href="https://www.theccpress.com/cryptexfinance-updates-bagz-etf-filing-24-crypto-tokens/" rel="noopener noreferrer nofollow">CryptexFinance Updates BAGZ ETF Filing With 24 Crypto Tokens</a>.
Key details about the exploit method, the identity of the attacker, the number of wallets affected, and whether any funds have been recovered remain unconfirmed as of publication. This article will be updated as verified information becomes available.
<h2 id="why-solana-trading-bot-users-may-be-exposed">Why Solana Trading Bot Users May Be Exposed</h2>
Trading bots, by design, require elevated access to user wallets. They need permission to sign transactions, often with minimal friction, so they can execute trades in milliseconds. That same speed and access is what makes them attractive to attackers.
When users connect wallets to automated trading tools, they typically grant broad token approvals or delegate signing authority. If any part of that trust chain breaks, whether through a compromised API key, a leaked private key, a malicious smart contract interaction, or a platform-level breach, the attacker inherits that access instantly.
It is worth noting that similar incidents have hit Solana infrastructure before. A high-profile controversy around the <a href="https://www.theccpress.com/arthur-hayes-drift-hack-solana-multisig-doubts/" rel="noopener noreferrer nofollow">Drift protocol hack previously raised questions about Solana’s multisig security model</a>, highlighting that the ecosystem’s speed advantages can compound risk when access controls are weak.
None of those specific causes have been confirmed in this case. The specific exploit path, whether it was a bot-platform vulnerability, a supply chain issue, or something else entirely, has not been publicly verified. Users should treat any unconfirmed technical explanations circulating on social media with caution.
CISA’s <a href="https://www.cisa.gov/resources-tools/resources/secure-by-design" rel="noopener noreferrer nofollow">Secure by Design guidance</a> broadly addresses how software products that require user-granted permissions should architect those trust boundaries, and the principles apply directly to crypto tooling that handles delegated wallet access.
<h2 id="what-affected-users-should-watch-for-next">What Affected Users Should Watch For Next</h2>
If you used a Solana trading bot recently and have not yet audited your wallet permissions, now is the time. Revoke any token approvals you do not recognize. Check your transaction history on <a href="https://solscan.io" rel="noopener noreferrer nofollow">Solscan</a> for any unauthorized outflows.
Do not act on recovery instructions from unofficial sources. In the aftermath of DeFi exploits, phishing attempts and fake “refund portals” are common. Wait for a verified announcement from the trading platform before taking any action beyond revoking permissions and securing your wallet.
Watch for an official post-mortem from the affected bot’s development team. That disclosure, if it comes, will be the first reliable source of information on the exploit vector, the scope of affected accounts, and any remediation steps. <a href="https://www.theccpress.com/hackers-breach-gmo-trading-cloud-26739-servers-risk/" rel="noopener noreferrer nofollow">Recent breaches affecting trading infrastructure</a> have shown that timelines for full disclosure can stretch days or weeks, especially when the investigation is ongoing.
The broader Solana ecosystem has faced scrutiny over security architecture in recent months. Debates about multisig design, validator behavior, and protocol-level controls continue, and <a href="https://www.theccpress.com/ethereum-retakes-dex-dominance-over-solana/" rel="noopener noreferrer nofollow">Ethereum has recently reclaimed DEX dominance over Solana</a>, a dynamic partly shaped by user confidence in on-chain security.
Nearly $1 million gone in under two minutes. The question now is whether the trading bot involved will be transparent enough, fast enough, to stop more from following.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The article <a href="https://www.theccpress.com/?p=49300" rel="noopener noreferrer nofollow">Solana Trading Bot Hack Drains Nearly $1M in SOL in 94 Seconds</a> first featured on <a href="https://theccpress.com/" rel="noopener noreferrer nofollow">theccpress.com</a>.

Solana Trading Bot Hack Drains Nearly $1M in SOL in 94 Seconds

Table of Contents

Cryptocurrency Press

Other articles published on Oct 26, 2026

Join our free newsletter for daily crypto updates!