The King bot lost $856K, not $786K. Two bridges froze a third of it.
A bot called King had been trading on Solana since at least July. We followed every coin taken from it, across two bridges to Ethereum, and checked the first reports against the chain.
- $856K
- 1 key
- 24 seconds
- 20%
- $280K
- 251 ETH
01 · What happenedWhat happened to the King bot
A Solana arbitrage bot that had traded all night went silent at 07:32 UTC on Monday. Less than half a minute later, its main wallet began sending all it held to a brand-new address. In under three minutes it was empty.
An arbitrage bot buys a coin where it is cheap and sells it where it is dear, many times a minute. This one is known as King. The name comes from its program, the code it runs on Solana, whose address starts with the letters "King". We could not find who runs it. On-chain watchers at Onchain Lens flagged the drain that evening, and Cointelegraph reported a loss of about $786K.
Bitquery traced each transfer out of the bot on Solana and followed the money across two bridges to Ethereum. The loss is larger than first reported, about $856K, because the early count left out the bot's USDT, a dollar stablecoin. The trail also shows the bot's own side offering the thief a 20% bounty, and two bridges refusing about a third of the money.
02 · How the bot worksHow an arbitrage bot works, and what its key controls
The price gaps such a bot hunts are for the same coin on two exchanges. It buys and sells in one transaction and keeps the difference. On Solana the gaps are tiny. They last a moment, so bots try nonstop. Most fail, because someone else got there first or the price moved. A failed try costs a fraction of a cent, so the bots keep trying. We covered that game in our study of failed swaps on Solana.
King fits the pattern. In the 11 hours before the drain, the bot's address was in about 30,000 transactions, and 96% of them failed. Each successful one we sampled called the King program. Each King call we sampled from the last half hour came from one of two accounts: the one that was drained, and a smaller second one.
To trade that fast, a bot keeps its private key on a server, where it is always ready to sign the next trade the moment a gap opens up. A private key is the secret code that approves transactions, and whoever has it can move everything in the wallet. That makes every bot wallet a hot wallet, one whose key sits on a machine connected to the internet.
03 · 146 seconds146 seconds on Monday morning
Five transfers carried the money. Each moved one coin to the same new address, BHRayE…d3jU. Three were dollar stablecoins: USDC, USDT and USD1. The other two were wrapped SOL, a token version of SOL that trading apps use, and plain SOL. That address had never been used before.
These were plain transfers. No smart contract bug was involved, and nobody else signed. Each one was signed by the bot's own key, so whoever sent them had that key or a machine that held it. This looks like a private key compromise, the same way traders lost money in the Bloom trading bot hack a week earlier.
04 · The bot went quietThe bot went quiet first
Both King wallets stopped trading within 4 seconds of each other. Nobody has called the King program since 07:32:26 UTC, and the first theft transfer came 24 seconds later.
Neither traded again. The second account still held about $36K, and it sat idle for more than an hour while the stolen money was already on the move. At 08:52 UTC, its funds were moved to the wallet that collects the bot's withdrawals.
The timing fits more than one story. Whoever took the money may have had access to the machine running the bot, and switched it off first. Or the owners noticed something wrong and stopped the bot, and the attacker moved seconds later. The chain shows when things happened, but not who pressed which button.
05 · Why it looks like theftWhy it looks like theft
Someone moving their own money would usually send it somewhere they had sent money before, and King's bot had such a place. Since 2 July, it had sent 22 withdrawals to one address, Ace7hX…KRby, the largest on 21 September. On Monday the money went somewhere new.
The owner side then acted like a victim. Just after noon UTC, the bot's key closed about 2,200 old token accounts. The small deposits locked in them, about 5 SOL, went to Ace7hX. Ace7hX co-signed some of those transactions, so whoever controls it still had the bot's key after the theft. The attacker had a copy of the key, and the owner side kept theirs.
That afternoon, Ace7hX sent BHRayE a tiny transfer with a message attached. It asks for 80% of the funds back within 48 hours and lets the holder "keep 20% as a white-hat bounty". That offer runs out at 13:22 UTC on 4 November. BHRayE has not replied on-chain.
None of this proves who held the key. But Ace7hX, which collected the bot's withdrawals for four months, treated the drain as a theft.
06 · Monday, hour by hourMonday, hour by hour
The attacker took its time. The owner side used the same hours to save what it could.
On the attacker's side, the longest gap is the wait of about 5 hours between the swaps and the first bridge transfer. The bounty note landed between the attacker's Relay and Mayan tries.
07 · From Solana to EthereumFrom Solana to Ethereum
The attacker's first move was to swap the stablecoins. The companies that issue USDC and USDT can freeze those coins in any wallet they pick, and SOL has no such switch. Starting 20 minutes after the theft, BHRayE swapped all the stablecoins to SOL on Jupiter, an app that finds the best swap price on Solana. It ended up with about 9,078 SOL.
Then it waited about 5 hours. At 13:07 UTC it began moving the SOL to Ethereum. It used two cross-chain bridges, apps that take coins on one chain and pay out on another.
All the bridge orders named one Ethereum address, 0xf2fb…63c1. Most of the SOL went through a deposit address run by a program. Nobody holds a private key for it. That program swapped each deposit and placed it as a Mayan order. This address is the "forwarder" in the first reports.
08 · How the bridges said noHow Mayan Finance and Relay froze $280K
Relay came first. A 1 SOL test went through to Ethereum. The next deposit, 499.99 SOL, did not: the Relay bridge marked it "BLOCKED_WALLET" and has not paid it out or refunded it.
The attacker switched to Mayan Finance and sent 13 deposits in 23 minutes. Mayan filled the first 10, then refused the rest. Its public records mark those last orders as blocked for a flagged address.
Frozen is not the same as recovered. Both bridges' records tie the blocked orders to the attacker's Solana deposit addresses, and any refund would likely go back there. For now the bridges hold the money, and Mayan's record lists a refund to Solana as pending.
09 · Where the money isWhere the $856K is now
Two thirds of the money reached Ethereum. It has not moved. The Ethereum address holds 251.19 ETH and had never sent a transaction when we last checked, on 3 November. The rest is stuck at the two bridges.
The Ethereum address can be watched with the Bitquery MCP, which lets you ask an AI assistant where a wallet's money goes next.
10 · The first reportsChecking the first reports
Onchain Lens raised the alarm the same day, and most of what was reported holds up. The gap is the USDT. It was taken in its own transfer and left out of the count.
| Claim | Record | Verdict |
|---|---|---|
| Onchain Lens: about $786K lost | About $856K, counting 69,869 USDT the first count missed | Too low |
| Onchain Lens: funds went to Ethereum via Mayan | Mayan and Relay; 251.15 ETH reached Ethereum through Mayan | Right |
| Onchain Lens: looks like a wallet compromise | Plain transfers signed with the bot's own key | Fits |
| TokenPost: 4,260 WSOL and 191 SOL | 4,264.57 WSOL and 191.24 SOL | Right |
| TokenPost: $366,000 in stablecoins | 359,094.73 USDC plus 7,173.93 USD1; the 69,869 USDT not counted | Partly |
| TokenPost: King made $7.2M in profit | We did not check this | Not checked |
11 · What it meansWhat the King hack means for bot builders
An arbitrage bot needs a hot key, and that key controls all the money. Clean code and good trades do not help once the key leaks. King's attacker never touched the King program. The attacker signed ordinary transfers with the bot's key, as in the LootBot key drain and the Solflare validator hack.
Two things limited the damage. The bot split its funds across two wallets, and only one of them was emptied, so the second could be saved in time. It also sent money to Ace7hX most weeks from July to September, so the drained account held less than it might have. An alert when the bot stops, or when money leaves for a new address, would add one more layer. Issuers can freeze USDT and USDC, but only until a thief swaps them for something else.
12 · How we traced itHow we traced the King drain
From a public Solana node we pulled every transaction of BHRayE, the deposit address and Ace7hX, and the bot's last 30,000 transactions. For each transfer in this story, we checked who signed it and what it moved. We read each bridge order from Mayan's and Relay's public explorers, and the Ethereum address from a public Ethereum node. Our address labels mark the bot's address as an MEV bot, our tag for trading bots like this one. Dollar values use prices from Bitquery's trading data at the time of each move.
The full Solana and Ethereum histories are also sold as files. Bitquery does this kind of tracing for clients through its crypto investigation services.
Transactions were read from public Solana and Ethereum nodes on 3 November. Balances were last read at 09:17 UTC on 3 November. Anything after that is not covered.
Bridge results come from the public explorers of Mayan and Relay. A blocked order can still be refunded or released later.
Dollar values use prices from Bitquery's trading data at the time of each move: SOL at $94.28 during the theft, ETH at $2,287 when it arrived. Stablecoins count at $1.
We call Ace7hX the bot's withdrawal address because the bot sent it 22 withdrawals since 2 July. We read Ace7hX's full history, but only the bot's transactions from 1 November, so the bot may have sent money elsewhere too.
The record shows which keys signed which transactions and when. It does not show who held the keys or how the bot's key was obtained.
13 · The addressesWhere to look
These are the main wallets and transactions in this story. Each description links to the explorer, and the Ethereum address holding the ETH is marked in green.
Follow the King drain in plain English
Every transfer in this story can be followed with Bitquery's data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which labels an address carries, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Solana dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any bot, bridge, protocol, exchange or service.
The findings describe transactions and balances observed on Solana and Ethereum between July and 3 November 2026. Attributions come from Bitquery's address labels and from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.
References to King, Onchain Lens, Cointelegraph, TokenPost, Mayan, Relay, Jupiter or any other named project, company, service or person describe what the public record shows about addresses and transactions linked to them, and what those parties have said in public. They are not statements about any party's intent, security practices or conduct, and nothing here asserts that any named party acted unlawfully or negligently. The wallets that took the funds are described by their behaviour and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
What happened to the King arbitrage bot?
On 2 November, someone used the King bot's own key to move about $856K in stablecoins and SOL out of its main wallet in under three minutes. The bot stopped trading seconds before.
How much was stolen from the King bot?
About $856K. The first reports said $786K because they left out the bot's USDT, which was taken in a separate transfer.
Was the King bot hack a smart contract bug?
No. Every transfer was a plain transfer signed with the bot's private key. Whoever sent them had that key, or a machine that held it.
Where did the stolen crypto go?
The attacker swapped the stablecoins to SOL on Jupiter, then bridged the SOL to Ethereum with Mayan and Relay. About 251.19 ETH reached one Ethereum address, which had not moved when we last checked.
Can the stolen crypto be recovered?
About a third, some $280K, is frozen at the Mayan and Relay bridges. A refund would likely go back to the attacker's deposit addresses, and the rest sits in the Ethereum address the attacker named.
Did the King bot's owner offer a bounty?
Yes. Ace7hX, the address that collects the bot's withdrawals, sent the attacker an on-chain message offering a 20% white-hat bounty for returning 80% within 48 hours. The attacker has not replied on-chain.
Run the next investigation in minutes
Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets, or query the chain directly with the Bitquery API.