King Solana arbitrage bot (November 2026) hack — November 2026

At 07:32 UTC on 2 November 2026 the main wallet of King, one of the longest-running arbitrage bots on Solana, was emptied to a newly created address in 146 seconds, 24 seconds after the bot made its last trade. The on-chain monitor Onchain Lens flagged the drain and told Cointelegraph the pattern strongly suggested a wallet compromise. The bot’s operator is not publicly known and has not commented.

Bitquery counts $856,000 taken in five transfers, all signed with the bot’s own key: SOL and wrapped SOL worth about $420,000, $359,000 of USDC, 69,869 USDT and $7,000 of USD1. Early reports of about $786,000 missed the USDT. The attacker swapped the stablecoins to SOL on Jupiter and about five hours later tried to bridge to Ethereum: Relay blocked a 500 SOL deposit and Mayan refused orders worth 232,875 USDC, together about $280,000, recorded here as recovered. About 251 ETH, roughly $574,000, reached one Ethereum address and had not moved by 09:17 UTC on 3 November.

The address that had collected the bot’s withdrawals since July sent the attacker an on-chain message asking for 80% back within 48 hours in exchange for a 20% bounty, an offer that expires at 13:22 UTC on 4 November. There had been no reply.