King Solana Arbitrage Bot Key Compromise

On November 2, 2026, King — one of Solana's oldest and most profitable arbitrage and MEV bots — had its main wallet drained of roughly $786,000. There was no smart-contract bug and no protocol to exploit: the funds left in ordinary native transfers carrying a valid signature, the signature of whoever had gained control of the wallet's signing key.

What happened

On-chain monitors, including the analytics account Onchain Lens, flagged unusual rapid transfers out of wallets tied to King and estimated the loss at about $786,000 — roughly 4,260 WSOL, 191 SOL, and about $366,000 in stablecoins. King was no small operator: the bot had accumulated around $7.2 million in lifetime profit and loss over years of running on Solana, making it one of the network's best-known arbitrage machines. SlowMist's incident tracker classified the event as a hot-wallet key compromise: once an attacker holds the private key, the bot's own always-online signing setup becomes the instrument of its theft, and the chain executes each outgoing transfer as a legitimate, validly signed transaction. King's operators had not publicly confirmed that the wallet was hacked at the time of the first reports.

Aftermath

The stolen assets were moved through several Solana wallets and then bridged toward Ethereum using the Mayan cross-chain service, a routing pattern consistent with an attacker trying to put distance between the theft and any freeze or trace. No attacker identity was established, and the funds were not tied to any specific group; the same day, investigator ZachXBT separately flagged a suspected unrelated $106 million theft involving exchange accounts, underscoring how active on-chain thieves were that week. King's operators had not announced any recovery or compensation.

Why it matters

The King drain is a compact lesson in the operational risk of automated trading: bots that arbitrage across pools must keep signing keys hot and online to act in milliseconds, and that same always-ready key is a single point of catastrophic failure if it leaks. The loss owed nothing to clever contract logic — it was the blockchain faithfully honoring a signature produced by the wrong hands, the same failure mode that felled the much larger Mercado Bitcoin hot-wallet breach days earlier. For anyone running custody-bearing automation, it is a reminder that key hygiene, not contract audits, is often the real perimeter.