A series of wallet-draining attacks on Solana within the past day may be associated with Telegram trading bots, although the team behind the most prominent one—BONKbot—denies any link to the exploit.

Numerous reports surfaced on Twitter in the past several hours regarding Solana wallets being emptied of their SOL, with some users attributing the incidents to BONKbot, a popular application developed by the team behind the Solana meme coin BONK. This application enables users to buy and sell Solana-based tokens via the messaging app Telegram.

Early on Friday, BONKbot refuted these claims, suggesting that affected users who had previously utilized the Telegram bot likely exported their private keys and used them in other applications.

"BONKbot is SAFE—but there are exploits being triggered elsewhere in the ecosystem!" the team stated on Twitter. "Our logs show that every user account being drained has previously exported their private keys. There are also non-BONKbot wallets being drained. BONKbot users who did not export their keys are SAFE."

In an update later that Friday afternoon, the team reported tracking 302 total victims of the wallet-draining incidents so far, with approximately 2,808 SOL stolen—equivalent to about $523,000 at the current price. BONKbot claimed that 113 of these victims had previously used its bot, but all had exported their private keys for use elsewhere.

"Our analysis strongly suggests the exploit occurred from those victims importing PKs into a specific application," BONKbot tweeted. However, the team did not disclose the identity of the alleged application. Decrypt reached out for clarification but did not receive an immediate response.

According to BONKbot's analysis, the largest single victim lost just over 500 SOL in the attack, equivalent to about $93,000.

There is widespread speculation on Twitter that a competing Telegram trading bot, Solareum, could be linked to the potential leak of private keys. In a tweet response, the team acknowledged to a Twitter user that "there [may be] a chance we got exploited," although the Solareum team also asserted that they were actually victims themselves.