Solareum Hack

On March 29, 2024, wallets belonging to users of Solareum, a Telegram trading bot for Solana tokens, were drained. The next day Solareum said it was shutting down, citing insufficient funds, market conditions and a recent security breach. Decrypt's early report put the loss at about $523,000 in SOL from more than 300 users. A US Justice Department court filing from January 2025, which DL News links to Solareum, later put it at 6,045 SOL, about $1.4 million.

The common thread among victims was that they had imported their private keys into Solareum. BONKbot was blamed at first, but its team showed that 113 of its users had exported keys from BONKbot into Solareum, not the other way around. A January 2025 DOJ filing says a North Korean developer helped steal 6,045 SOL from the users of a trading bot it calls only "US Company 1". DL News reported that the details in the filing point to Solareum, and MetaMask researcher Taylor Monahan, who found on-chain overlaps with previous thefts by North Korean IT workers, believed the affected company was Solareum. DL News also noted that in December 2023 the Solareum team said in its support channel that it was "onboarding a new dev", and that it appears the team hired the developer without knowing who he was. No compensation was announced, and Solareum has not posted on its social media accounts since March 2024. The stolen SOL was converted to USDT and moved through several exchanges. Tether froze about $1 million in USDT on March 30, and the FBI later seized about $950,000.