How to Protect Your Seed Phrase From Bots
A Telegram trading bot never needs your seed phrase. How bots reach your funds, how fake bots and support accounts steal the phrase, and the routine that keeps it offline.
Published 2026-11-13
Does a Telegram trading bot need your seed phrase?
No. A Telegram trading bot reaches your funds through a wallet it creates for you when you start, or through a private key you import for one specific wallet. Neither path needs the phrase that restores your whole wallet, and no legitimate bot will ask for it.
Your seed phrase restores the entire wallet and is never needed to trade through a bot. Anyone who has it controls every address that wallet generates, on every chain, without needing your phone, your Telegram account or your password.
What the bot actually needs
In practice, a bot needs two things:
- A wallet address to trade from, so it knows which balance to work with.
- A key for that one wallet, either one the bot generated for you or one you imported yourself. That key controls a single trading wallet, not the wallet you keep your long-term holdings in.
Notice what is missing from that list: the master phrase. Trading, sniping and limit orders all run on the key for the trading wallet alone.
The request usually arrives as maintenance
Seed phrase requests are rarely phrased as requests. They arrive as housekeeping:
- "Validate your wallet to continue."
- "Sync your wallet for the airdrop."
- "Restore your wallet to migrate to v2."
All three describe an upgrade or a check. None of them is a real bot function. A bot that already has your trading key has nothing to validate, and a migration never requires the phrase of a personal wallet.
Support that messages you first is not support
The bot interface is the bot. Genuine support does not open a direct message with you, and it does not ask you to prove ownership of a wallet by typing words into a chat. Treat every inbound message about your wallet as an attempt to take it, including messages forwarded from a group you trust.
The rest of this guide is the routine: what a bot holds, how the fake handles and fake support accounts work, how to check a handle before you deposit, which wallet to trade from, and what to do if a phrase has already gone into a chat. Read it as a setup checklist, not as reassurance that these things are rare.
What a Telegram trading bot actually holds
A bot does not reach into your wallet. It signs trades with a key that sits on the bot's side, which is why trades can run while your Telegram app is closed.
Two setups you will meet
Most bots work one of two ways:
- A wallet the bot generates on first use. You start the bot, it creates a fresh wallet, gives you the deposit address and keeps the key. You fund that address and trade from it inside the chat.
- A key you paste in. You import a wallet you already have by giving the bot its private key. The bot then trades that wallet the same way it would trade one it made itself.
Both end in the same place: a key that the service holds and uses on your behalf.
What the bot stores
The bot stores what it needs to sign a transaction, which is a private key. That is a different object from a seed phrase. What the bot keeps is signing material for one wallet, not the master backup that regenerates a whole wallet and every address in it. Your backup belongs offline, not in a chat.
Hot wallet by design
Any wallet a bot operates is a hot wallet: online, attached to a running service, and funded with whatever you choose to send it. Keep the balance at the level you are trading with, not the level you are holding.
One wallet, not every wallet
The bot operates one wallet. Holdings in a hardware wallet, an exchange account or a separate wallet you never imported sit outside that arrangement. Keep the trading wallet apart from the rest, and a leak in the bot's wallet need not reach anything else.
Why no bot needs your seed phrase
A seed phrase is not a password for one trading session. It is the master backup for an entire wallet. Type the same twelve or twenty-four words into any compatible wallet app and it rebuilds everything derived from it: every address, every chain that wallet supports, every account under that phrase.
That is the whole point of it, and it is why the request never makes sense.
The phrase controls everything at once
If someone else holds your seed phrase, they do not need the bot, the app, your phone or your permission. They restore the wallet on their own device and the funds are simply there to move. There is no second step, no confirmation prompt, no limit on which addresses they can reach.
A single private key is narrower. It controls one address, and on EVM chains one address across the chains it is used on. Even a leaked private key is a smaller problem than a leaked phrase, because the phrase regenerates the wallet that contained that key and every other key beside it.
What a bot actually needs
Trading requires signing transactions from the wallet that holds the funds. That takes a key the bot can use, or a wallet the bot creates and controls on your behalf. It does not take the master backup of your wallet. Two different things.
So when a bot asks for the seed phrase, it is asking for something with no trading purpose. A bot that cannot place an order without the phrase that restores your whole wallet is not designed for trading. Whatever it is designed for, it is not that.
The practical rule: the phrase stays offline. Anything in a chat window asking for it is a request to take over the wallet, not a setup step.
Seed phrase, private key, bot wallet: the difference that matters
These three are often used as if they mean the same thing. They do not, and the difference decides how much you lose if one of them leaks.
The seed phrase
A seed phrase is the master backup of a wallet: usually 12 or 24 words, in a fixed order. From it, a wallet app regenerates every address and every private key that wallet derives. Anyone who has the words has the whole wallet, not one account inside it.
The private key
A private key belongs to one address. It signs transactions for that address and nothing else. If you export a single private key from a wallet, you hand over one account while the rest of the wallet stays out of reach.
The bot wallet
The bot wallet is the hot wallet a trading bot operates: an address the bot creates for you, or one you import by giving it a key. It is a working account with funds in it, connected to the internet and controlled by software you did not write.
| What it restores | What it controls | Who should hold it | |
|---|---|---|---|
| Seed phrase | The entire wallet and every address derived from it | Everything in that wallet, now and later | You, offline, on paper or steel |
| Private key | One address | That address only | The bot, if you chose to import |
| Bot wallet | Nothing on its own | The trading balance you funded | The bot, while you trade |
The practical consequence
A leaked private key costs you one wallet. A leaked seed phrase costs you every wallet derived from it, including wallets you have not created yet. That forward reach is the reason the phrase belongs in one place only: an offline backup. It never goes in a bot chat, a form, a "restore" screen opened from a link, or a note that syncs to a cloud account. No bot needs it, because the key it trades with is not the key that rebuilds your holdings.
Fake bots and fake support: the Telegram-native attacks
Every attack below happens inside Telegram itself. None of them breaks encryption. Each one needs you to trust a name, a message or a link that arrived in a chat.
Lookalike handles
An impersonator copies a bot's profile picture and display name, then registers a username one character off: an extra underscore, a swapped letter, a word added at the end. Display names are not unique on Telegram, so "@bonkbot_bot" and an account called BONKbot with the username "@bonkbot_support" can look identical at a glance in a chat list. Read the username, character by character, never the display name.
Fake support that messages first
Real support does not open your conversation. Impersonators watch public groups, wait for someone to post "my withdrawal is stuck", then message that person directly offering to "check your wallet" or "whitelist" it. The next step is always a link or a request for the phrase. Treat any unsolicited DM about your funds as hostile.
Airdrop and validation bots
These promise a token, a refund or a "wallet sync" you never asked for. Claiming it means connecting a wallet to a site or typing a seed phrase into a form. A phrase form is the whole attack: no legitimate claim needs one.
Forwarded announcements and cloned groups
A forwarded message can carry a bot's real logo and old announcement text, with the link swapped for a copy of its interface. Cloned groups go further, pinning "updated instructions" that route you to a fake bot or a phrase form. Pinned does not mean official; admins can pin anything.
| What you see | What it wants |
|---|---|
| Extra underscore or swapped letter in the username | You to start the fake bot |
| Support DM after a group question | Your phrase or a "validation" link |
| Airdrop or validation bot | Wallet connection or phrase entry |
| Forwarded announcement with a link | Login on a cloned interface |
| Pinned "updated instructions" in a group | A fake bot or phrase form |
The common thread: every one needs you to act from a chat. So never act from a chat. Open the bot's own website and start from there.
How to verify a bot's official handle before you deposit
Start at the bot's website, not at a search result
The only reliable starting point is the bot's own website. Open it in a browser, find the link to the official Telegram account there, and open the bot from that link. The site is the authority on which handle is real.
Do not start from a Telegram search, a message in a group, a forwarded "airdrop" post, a pinned instruction in a channel, or a page from a general search engine. Every one of those routes can be pointed at an account that looks identical and is not.
Compare the handle character by character
Once the bot opens, compare the username at the top of the chat with the one on the site you just came from. Check every character: underscores at the start, middle or end, capital letters, doubled letters and any trailing word after the main name. Impersonators rely on readers who glance rather than read.
| Bot | Official Telegram handle | Bot's own website |
|---|---|---|
| Banana Gun | @BananaGun_bot | bananagun.io |
| Bloom | @BloomSolana_bot | bloombot.app |
| BONKbot | @bonkbot_bot | bonkbot.io |
| GMGN | @GMGN_sol_bot | gmgn.ai |
| Maestro | @maestro | maestrobots.com |
| Pepeboost | @pepeboost_sol_bot | pepeboost.io |
| Sigma | @Sigma_buyBot | docs.sigma.win |
Keep a bookmark and watch for changes
Bookmark the bot's site and return through that bookmark each time you need to reinstall the bot, switch device or check a new feature. If a bot's message history suddenly disappears from your chat, re-check the handle from the bookmarked site before you touch the account again. A fresh chat that appears in place of the old one is a common way to swap a real bot for a copy.
When there is no published handle
Some bots do not publish a Telegram handle on their own site. Those cannot be verified this way, so treat them with extra caution before you connect a wallet or send funds.
The full list of bots is on /bots, and most of the handles above trade on Solana, covered on /chain/solana. Check the official handle on a bot's own page before you create a trading wallet for it, not after.
Set up a trading wallet that cannot hurt your main holdings
A bot wallet is a hot wallet. It stays online, it signs trades on demand, and it is only as safe as the bot, the device and the chat account that control it. Treat its balance as spending money, not as storage.
Create a new wallet, do not import the old one
Generate a fresh wallet for bot trading and fund it only with what you are prepared to trade. Never import the wallet that holds your long-term balance. Importing an existing wallet means the same key sits behind every bot you connect, and one bad approval or one compromised bot reaches everything that wallet owns.
If you already use a wallet elsewhere, leave it alone. A wallet that has been used for other purposes, or whose key has been pasted into another bot or site before, is not a clean starting point.
Choose custody deliberately
| Bot-generated wallet | Key imported into the bot | |
|---|---|---|
| Who holds the key | The bot | You and the bot |
| What you back up | The phrase the bot gives you | The phrase you already hold |
| What to fund it with | Only what you trade | Only what you trade |
A bot-generated wallet moves the key management to the bot. An imported key keeps a copy with you, but the bot holds one too. Both are online wallets and both fail the same way if the bot is not the one you think it is. Check the handle before you create either, on the bot's own page such as /bot/bloom or /bot/bonkbot, and see the full list at /bots.
Back up and label before funding
- Write the new wallet's seed phrase on paper or steel, offline, before you send anything to the address.
- Keep it out of chats, cloud notes, password managers synced to a browser and your photo library.
- Record which wallet belongs to which bot, with the address written down. Separate wallets per bot stop a compromise in one place turning into guesswork about the rest.
Fund the wallet after the backup, not before.
Approval hygiene: revoke what you no longer use
A seed phrase is one way into a wallet. A token approval is another, and it never asks for the phrase.
What an approval is
On EVM chains such as Ethereum, BNB Chain, Base and Arbitrum, a token does not move because a contract holds a key to it. It moves because you signed a permission allowing that contract to spend that token from your address, either up to a set amount or without a limit. The trade finishes. The permission does not. A contract you approved months ago can still move that token until you withdraw the permission.
How to clear them
- Open your wallet's own approval manager, or the token approval page of the block explorer for that chain.
- Read the list: which contract, which token, what allowance it holds.
- Revoke what you no longer use: bots you have stopped trading with, contracts you touched once, anything you cannot place.
- Treat a bot you abandoned like a login you forgot about.
Revoking removes the permission and nothing else. It does not move funds, close a position or change a balance.
Why a small trading wallet helps
An approval can only reach what sits in the address that granted it. A trading wallet funded with the amounts you actually trade, topped up when you need it, caps what any single stale approval can expose. That is the practical argument for keeping the bot wallet separate from the wallet holding your long-term assets.
A separate risk from the seed phrase
A drain through an approval never asks you for a seed phrase. It uses a permission you gave earlier, sometimes to a contract that looked ordinary at the time. Protecting the phrase and clearing approvals are two different habits, and holding one does not cover the other.
After you finish a trading session, take a minute in the approval list and revoke what you will not use again.
What to do if you have already typed your seed phrase into a bot
Assume the wallet is exposed
A seed phrase rebuilds the whole wallet and every address in it. Once you have typed it into a chat, a form or a page opened from a link, control of that wallet has effectively left your hands. Act on that basis instead of watching the address for unusual activity first. A quiet wallet proves nothing: whoever holds the phrase can wait as long as they like and move funds when it suits them.
Create a new wallet with a new phrase
Generate a fresh wallet in software you trust, or offline, and write the new phrase on paper. Do not reuse the old phrase under any circumstances. A new phrase gives you new addresses, which is the entire point of the exercise. Even if the bot you typed it into turns out to be the genuine one, treat the old wallet as compromised.
Move what is still there
Start with the assets that are quickest and simplest to move, then work through the rest. Confirm the destination address character by character before you send. Anything left in the exposed wallet stays at risk while it sits there: a sweeper watching the address can take arriving funds immediately, including tokens you transfer in by mistake while cleaning up.
Cut the approvals and the link
Revoke the token approvals the exposed wallet granted, so contracts cannot continue spending on its behalf. Stop using any bot that was connected to that wallet and start again with the new address.
Ignore anyone offering to fix it
No service can reverse a transaction or restore a phrase that has already been taken. Messages offering a recovery tool, a rescue service or a second look at your phrase are the same request in a new wrapper. Do not pay, do not click, do not reply.
This is not legal, tax or financial advice.
A short seed phrase routine
The habits below take a few minutes to set up and a few seconds to follow. They are about where the phrase lives and who ever sees it.
Where the phrase lives
- Write it on paper or stamp it into steel, by hand, from the wallet's own setup screen.
- Store it offline, in a place you control and can reach without a screen.
- Never photograph it. A photo sits in a camera roll that may sync to a cloud account.
- Never keep it in a cloud note, an email draft, a password manager entry or a Telegram Saved Messages folder.
- Keep the phrase for your trading wallet separate from the phrase for any long-term wallet. If one leaks, the other holdings stay out of reach.
What you never do with it
- Never type it into a chat, a bot, a website form or a pop-up opened from a link.
- No legitimate trade needs it. A bot trades from the wallet it creates for you, or from a key you import, and neither requires the phrase that restores your whole wallet.
- Never paste it to "restore" or "sync" a wallet on a page you reached from Telegram. Open the wallet app you installed yourself and restore from there.
- Arrive at every bot from its own website, and check the handle character by character each time instead of trusting memory. The full list is on /bots.
What these steps cover, and what they do not
Trading through a bot can lose all of the money you put in. A token can go to zero, and a bot that holds the key to your trading wallet can lose whatever sits in it. These steps limit the ways a seed phrase can leak. They do not lower trading risk, and they do not turn a bad trade into a good one.
Nothing here is legal, tax or financial advice.
Compare Telegram trading bots side by side and start from the official listing rather than a search result.
Frequently asked questions
Does a Telegram trading bot need my seed phrase?
No legitimate bot needs the words of your seed phrase. A trading bot either creates a wallet for you inside Telegram or asks you to import a private key, and in both cases the key sits with the bot. Those twelve or twenty four words are the master key to the whole wallet: anyone who has them can move every token, on every chain, without asking you again. Treat a request for them as a red flag, whoever sends it. If a bot cannot work without a key, fund that wallet with trading money only, never with a wallet you use for holding.
Can a scammer read my seed phrase from a Telegram message?
Yes, in practice. Ordinary Telegram chats, including chats with bots, are cloud chats stored on Telegram's servers, not end-to-end encrypted conversations between two devices. Anyone who controls the receiving account, or who gets into it, can scroll back and read the words. Messages also survive on your own devices and in backups. A seed phrase typed into Telegram should be treated as public from that moment: move the funds to a new wallet, generate a fresh phrase offline, and stop using the exposed one.
How do I tell a fake bot from the real one?
Open the bot's own website and copy the handle from there, character by character. Fake bots copy the name and avatar and change one letter, add an underscore or swap a word, so compare the exact username, not the display name. Official examples: @BananaGun_bot, @BloomSolana_bot, @bonkbot_bot. Ignore handles sent in direct messages, group chats, comment replies or ads. A real bot does not message you first to announce a migration, an airdrop or a fix. Pin the real handle once verified, and start each session from that pinned chat.
Do I need a separate wallet for each bot?
A fresh wallet per bot is the safer default. If a bot holds your private key and that key is compromised, only the funds in that wallet are exposed, and you can abandon it without touching your main holdings. Keep each bot wallet small, roughly what you are willing to trade, and top it up when you need it rather than parking a balance there. Sharing one wallet across several bots means a single leak, a single bug or a single fake bot drains everything at once, including funds you never meant to trade.
What should I do if a support account asks me to validate my wallet?
Nothing good happens after that message. No bot and no support person needs you to "validate", "sync", "migrate" or "whitelist" a wallet, and none of those steps involve typing your seed phrase or approving a transaction. Stop replying, do not click links, do not connect anything. Check the bot's official handle on its own website and contact it through that channel only. If you already shared the phrase or signed, move remaining funds to a new wallet immediately and create a fresh seed phrase offline.