Long-running Solana arbitrage bot King drained of about $786K in suspected wallet compromise

Summary

On 2 November 2026 on-chain monitor Onchain Lens reported that King, described as one of Solana's oldest arbitrage bots with about $7.2M in lifetime PnL, was drained of about $786K: roughly 4.26K WSOL, 191 SOL and $366K in stablecoins. SlowMist's Hacked database lists the incident at $786,000 with the attack method "Unknown". Press reports citing Onchain Lens say the funds moved through several Solana wallets and were then bridged to Ethereum via Mayan, and that the pattern suggests a possible wallet compromise.

Affected

• Operator wallet(s) of the Solana arbitrage bot "King"
• Root cause not disclosed; the operator had not confirmed a compromise at time of publication

Impact

About $786K in WSOL, SOL and stablecoins was moved out of the bot's wallet to the drainer address named by Onchain Lens and on through a forwarder. No exploit technique has been confirmed by the operator or a security firm.

Recommended actions

• Block or flag interactions with the drainer and forwarder addresses listed as indicators.
• Bot and searcher operators: rotate hot-wallet keys held on trading infrastructure, review server access, and keep only working capital in hot wallets.
• Bridges and exchanges: monitor for inbound funds traced from the listed addresses, including Mayan transfers to Ethereum.

Source & attribution

This 0xCERT advisory summarises an alert by Onchain Lens: https://x.com/OnchainLens/status/2117318995460476935, with corroboration from SlowMist Hacked (https://hacked.slowmist.io/) and reports by Cointelegraph and PANews. Details may change; refer to the original source for the authoritative record.