King Solana Arbitrage Bot Key Compromise
Attackers drained roughly $786,000 from the main wallet of King, one of Solana's oldest and most profitable arbitrage bots, in a run of plainly signed transfers pointing to a compromised key.
Vuln-watch · relayed from a public source; see Source & attribution below
Summary
Attackers drained roughly $786,000 from the main wallet of King, one of Solana's oldest and most profitable arbitrage bots, in a run of plainly signed transfers pointing to a compromised key.
Incident
- Victim: King
- Date (UTC): 2026-11-02
- Estimated loss: $786k
- Chain(s): Solana
- Attack type: private key compromise
- Funds status: stolen
Recommended actions
- If you use King, move funds to a fresh wallet with a new seed phrase once the vendor confirms the root cause
- Update the wallet software only from official sources
- Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only
Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/king-bot-2026. Primary sources: https://cointelegraph.com/news/zachxbt-flags-suspected-106m-crypto-theft-as-solana-bot-faces-possible-786k-drain ; https://www.tokenpost.com/news/technology/46972 ; https://www.techflowpost.com/en-US/newsletter/142597 ; https://hacked.slowmist.io/.
References
Indicators of compromise
All IOC feeds →- addressBHRayETPjvgg3BCr9H82V1D6NRwxu5v44JAaVuaod3jUDrainer - named by Onchain Lens in the King bot drain · Solana
- addressDdmy5oM8xtTs1EBC6eF2SZwQfBreewQpFgtUDm51HkqjForwarder of drained funds - named by Onchain Lens · Solana
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-11-02 · last updated 2026-11-07
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0321/signed.txt | gpg --verify