-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0311
============================================================

Advisory-ID:  0xCERT-2026-0311
Severity:     Medium
Published:    2026-11-02T18:12:41.000Z
Updated:      2026-11-05T04:43:06.394Z
Chains:       Solana
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0311

Title: Long-running Solana arbitrage bot King drained of about $786K in suspected wallet compromise

Summary
- -------
King, one of Solana's oldest arbitrage (MEV) bots, was drained of about $786K (4.26K WSOL, 191 SOL, ~$366K in stablecoins) on 2 Nov 2026, per Onchain Lens. The operator has not confirmed a cause. Treat the listed drainer and forwarder addresses as hostile.

Details
- -------
Summary
On 2 November 2026 on-chain monitor Onchain Lens reported that King, described as one of Solana's oldest arbitrage bots with about $7.2M in lifetime PnL, was drained of about $786K: roughly 4.26K WSOL, 191 SOL and $366K in stablecoins. SlowMist's Hacked database lists the incident at $786,000 with the attack method "Unknown". Press reports citing Onchain Lens say the funds moved through several Solana wallets and were then bridged to Ethereum via Mayan, and that the pattern suggests a possible wallet compromise.

Affected
- - Operator wallet(s) of the Solana arbitrage bot "King"
- - Root cause not disclosed; the operator had not confirmed a compromise at time of publication

Impact
About $786K in WSOL, SOL and stablecoins was moved out of the bot's wallet to the drainer address named by Onchain Lens and on through a forwarder. No exploit technique has been confirmed by the operator or a security firm.

Recommended actions
- - Block or flag interactions with the drainer and forwarder addresses listed as indicators.
- - Bot and searcher operators: rotate hot-wallet keys held on trading infrastructure, review server access, and keep only working capital in hot wallets.
- - Bridges and exchanges: monitor for inbound funds traced from the listed addresses, including Mayan transfers to Ethereum.

Source & attribution
This 0xCERT advisory summarises an alert by Onchain Lens: https://x.com/OnchainLens/status/2117318995460476935, with corroboration from SlowMist Hacked (https://hacked.slowmist.io/) and reports by Cointelegraph and PANews. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://x.com/OnchainLens/status/2117318995460476935
- - https://hacked.slowmist.io/
- - https://cointelegraph.com/news/zachxbt-flags-suspected-106m-crypto-theft-as-solana-bot-faces-possible-786k-drain
- - https://panews.io/articles/01a19ed0-f4b9-72ea-8fb1-6115fd3dbc41

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrtEcQJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmeB1yEAw100pLvCv34WqcogQrgaVQqKG3aDjeY1
Um6pPxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAC5DQEA/Sha7FCeVdtAtemO
m2lt9LECWLUH0waGslSxwaHrQHMA/RLnxoKjN1IQfKwrJl0yleHH8UV5luHS
DfnEr00ADfMF
=fmFH
-----END PGP SIGNATURE-----