Solana King Bot Drain Revised to $856,000 After Fifth Transfer

By Tom Whitfield

A Nov. 3 review of King's on-chain transfers put the amount taken from the Solana arbitrage bot at about $856,000. The review also recorded about $280,000 blocked at two bridges by 4:17 a.m. ET, or 09:17 UTC.

The Nov. 2 drain moved funds out of King through five transfers completed over 146 seconds, a span shorter than three minutes. The revised total includes 69,868.77 Tether (USDT) omitted from the initial $786,000 estimate and measures the amount taken across all five transfers; the review had not established a final net loss.

The review therefore measures gross funds taken across the transfer sequence, not the bot's final economic loss. The fifth transfer changed the known amount moved, rather than establishing a final loss after the disposition of blocked funds and remaining assets.

What changed in the $856,000 estimate?

The omitted 69,868.77 USDT explains why the earlier $786,000 estimate understated the revised total, which rounds to $856,000. That distinction governs how the incident appears in financial and risk records. “Amount taken” records gross transfers out of the bot, while “net loss” would require a later accounting of what remained available and what, if anything, returned.

No final net-loss calculation was available at the review cutoff. The 146-second window also shows the limits of reviewing a single transaction. Because the USDT transfer had been absent from the first estimate, the revised number depends on aggregating all five transfers rather than relying on the largest individual movement.

The review supports a precise description: five outbound transfers and their combined value, not a completed loss-and-recovery ledger. That description avoids treating inaccessible funds as permanently lost while also avoiding a premature claim that funds had returned to King.

What does the bridge block establish?

About $280,000 was blocked at two bridges by the Nov. 3 cutoff. Another 251.19 Ether (ETH), then valued at about $574,000, sat at one Ethereum address, and the review reported no recovery by that time.

The bridge action constrained the $280,000, but the review cautioned that blocking funds does not mean recovering them. Until the blocks become completed recoveries, the $280,000 remains a blocked amount rather than a confirmed return to King.

The cutoff leaves two asset categories on the record:

• About $280,000 blocked at two bridges, with no recovery reported.
• 251.19 ETH, then worth about $574,000, observed at one Ethereum address and not recovered by the cutoff.

The ETH dollar figure carried a time-specific valuation. The stated $574,000 therefore represents the cutoff snapshot, not a completed recovery value or a final accounting for the bot's loss.

Why is the Arkéa incident separate?

Crédit Mutuel Arkéa confirmed on Nov. 4 that attackers reached its account through a service provider's platform and transferred the bank's funds to other banks. In its statement, the bank said: “Customer assets were unaffected.”

The bank disclosure is separate from the Nov. 2 King drain and should not be added to the $856,000 theft estimate. It concerns a French bank's account rather than a Solana arbitrage bot, and the available facts identify no connection between the two incidents.

Operationally, the disclosed route places service-provider platform access inside the bank's transaction perimeter. Arkéa's statement that customer assets were unaffected limits the disclosed customer impact, while the onward transfers shift the recovery question to other institutions not named in the disclosure.

What comes next?

Any further Arkéa update would need to identify the receiving banks and the status of the transferred funds. For King, the next material evidence would be a completed recovery or a final net-loss calculation covering the blocked $280,000 and the 251.19 ETH balance.

A completed recovery would change both the recovered-funds total and the bot's final net loss. The next decisive update for King is whether the two bridge blocks become completed recoveries. Until then, $856,000 remains the gross amount taken, not money returned.