How to Spot a Fake Telegram Trading Bot
A practical way to check whether a Telegram crypto trading bot is genuine: website, docs, username, contract address and what the bot asks you for.
Published 2026-11-09
The short answer: check the identity chain
A fake Telegram trading bot is not spotted by how it looks. It is confirmed or ruled out by comparing the account in front of you with what the product's own website and documentation publish.
That comparison has an order. Website first, then documentation, then username, then contract address, then the way the bot replies to you. Each link has to agree with the one before it.
The chain, in order
- Website. Reach the bot's own site from a source you chose, not from the message that brought you the bot.
- Docs. The documentation domain is linked from that site and links back to it.
- Username. The handle in the docs matches the handle you are about to open, character by character.
- Contract address. If the product publishes one, it matches what the bot asks you to approve.
- Replies. What the bot says and asks for matches how the documented product behaves.
One match proves nothing
A display name costs nothing to copy. So does a logo, and so does a paragraph of description. A DM can call itself Banana Gun and show the same picture. The username is the part that has to be identical: @BananaGun_bot is the handle published in Banana Gun's own materials, and a variant with an extra underscore or a trailing word is a different account.
A break is a stop
Treat any mismatch as a stop, not as a detail to weigh up. One broken link means the account in front of you has not been verified, whatever the rest of it looks like.
Where the check ends
The check ends the moment anything asks for your seed phrase, your private key, or a wallet connection described as "verification". Neither a real bot nor its team needs any of these.
Passing the chain tells you which account you are talking to. It does not tell you that funding it is safe.
Three shapes a fake bot takes
Most fakes fall into one of three patterns. They look different at first, but they break in the same place.
Shape one: the impersonator
An account copies a real bot's name and logo, then picks a username one character away from the handle the product publishes. An added underscore, a dropped letter, a capital in the wrong place, or a trailing "bot" that the original does not have. To make the account convincing, it may even point you to the real product's own documentation. That is what makes this shape the most dangerous: almost everything you check can be genuine, the docs, the fee page, the feature list, and the account in front of you is still not the product.
Shape two: the invented brand
A plausible name, a one-page website, and a list of features with nothing behind them. No named operator, no documentation history, no support channel with a past. The site exists to collect deposits for a product that has no trading track record because there is no product. These are often promoted through paid ads, group comments or a friendly DM.
Shape three: the fake support account
This one contacts you first. It offers help with a bot you already use or are about to use, then steers you towards "verification", an account upgrade, a new handle, or an activation step. A real team does not open a conversation with you.
| Shape | How it reaches you | What gives it away |
|---|---|---|
| Impersonator | Group comments, DMs, search results | Username differs from the published handle |
| Invented brand | Ads, forwarded links | One page, no documentation history |
| Fake support | A DM sent to you unprompted | You did not start the conversation |
All three fail the same test: the product's own website and documentation will not name the account that is talking to you.
Start on the website, not in Telegram
The check runs in one direction: website, then docs, then handle, then contract address, then the bot's own replies. Each link has to agree with the one before it. That means the chain is only as strong as the point where you start it.
Why the starting point decides everything
A direct message can hand you a link to a lookalike site. That site can publish a lookalike handle, point to lookalike docs and show a contract address that matches all of it. The chain agrees with itself perfectly, from the wrong start, and every later check confirms a fake.
So the first link has to be one you chose, not the one you were sent.
A starting point you chose yourself
- Type the project name in yourself and read the domain before you click anything. A doubled letter or a swapped word is hard to see on a phone screen.
- Or open the site from a source you already use, a bookmark or a link you saved earlier.
- Then compare the address bar with the name you expected, character by character, before you go further.
What a real product page shows
A genuine bot's site names the product, lists the chains it supports, links to documentation on its own domain and states the Telegram handle it wants you to use. Banana Gun's own documentation publishes @BananaGun_bot; Trojan's publishes @solana_trojanbot at docs.trojan.com. The site, the docs and the handle should all say the same thing.
The tell in the other direction
If the site is a single screen with a connect button, no documentation, no company detail and no history, there is nothing to verify. Whatever it promises, you have no second link to compare against, and one page on its own proves only that someone paid for a domain.
The message is the claim. The website is where the check starts. They are never the same thing.
Compare the username, not the display name
Two fields sit at the top of every Telegram profile. The display name is free text: anyone can type "Banana Gun", "Trojan" or "Maestro" into it, and the app will show it without complaint. The username is the unique @handle, and it is the only part of the profile that has to match a specific string. Compare the handle. Ignore the name.
One worked comparison
Banana Gun's own site publishes the handle @BananaGun_bot. A DM arrives from an account with the display name "Banana Gun" and the username @BananaGun_help. The name says one thing and the handle says another. The account is not the one the site names, and there is nothing further to review.
The same test takes seconds elsewhere. Trojan's documentation publishes @solana_trojanbot, Maestro's publishes @maestro, Sigma's publishes @Sigma_buyBot. Read the handle in front of you, then read the handle the bot's own documentation lists, and compare them character by character.
| Bot | Handle its documentation publishes | Lookalike to reject |
|---|---|---|
| Banana Gun | @BananaGun_bot | @Banana_Gun_bot, @BananaGunBot |
| Trojan | @solana_trojanbot | @solana_trojan_bot, @trojansolana_bot |
| Maestro | @maestro | @maestro_bot, @maestro_support |
| Sigma | @Sigma_buyBot | @SigmaBuyBot, @Sigma_buy_bot |
The lookalike checklist
- An extra underscore or a missing one: @Banana_Gun_bot instead of @BananaGun_bot.
- A trailing "bot" added where the real handle has none, or dropped where it has one.
- Doubled characters: @Sigmaa_buyBot.
- Swapped capitalisation.
- An added word such as help, support, verify or official: @maestro_support, @bananagun_verify.
- A hyphen where the real handle uses an underscore.
Case and the shape of a word
Telegram treats usernames as case-insensitive when delivering a message, so @bananagun_bot and @BananaGun_bot can reach the same account. That does not make lookalikes harmless. On screen, @BananaGun_bot and @BananaGun_b0t sit in the same font at the same size, and the eye reads the shape of the word rather than each character. Compare the characters, not the silhouette.
The limit of this check
Some bots publish no handle in their own documentation. For those, the website-to-Telegram step carries the whole weight: the site you found and typed yourself has to point at the account. A bot with no website and no docs gives you nothing to verify.
A handle you picked up from a group comment, an ad or a search result is a claim from a stranger, not a source.
Make the docs prove they belong to the bot
A real documentation setup has four parts that agree with each other. The docs sit on their own domain. The product website links to that domain. The docs link back to the website. And the docs name the same Telegram username the website names. Copy one characters at a time, in both directions.
The check, in practice
Open the docs by clicking the link on the bot's own website, not by typing an address you were given. Then find the fee page or the FAQ, because that is where bots usually state their handle next to the trading fee. Read the handle there, not in a screenshot or a forwarded message.
| Bot | Documentation | Handle stated there | Fee stated there |
|---|---|---|---|
| Banana Gun | bananagun.io | @BananaGun_bot | 0.5% Ethereum trade fee |
| Trojan | docs.trojan.com/faqs | @solana_trojanbot | 1% Solana trade fee |
| Maestro | docs.maestrobots.com | @maestro | 1% trade fee on every supported chain |
| Sigma | docs.sigma.win/other-info/fees | @Sigma_buyBot | 1% Ethereum trade fee, 0% Solana |
Now run it backwards. Take the handle from the docs and confirm the website names that same handle. If the site says @BananaGun_bot and the docs say @BananaGun_bot, the link holds. If either side is silent, or the two differ by one character, it does not.
Where the chain breaks
- Documentation hosted on a free subdomain with no link from the product site.
- A "docs" link that opens a Telegram channel instead of documentation.
- A document that explains features but never names a handle, leaving nothing to compare.
Documentation proves an operator exists and publishes an identity. It does not prove the code is safe, and it says nothing about how trading will go.
A bot with no published fee anywhere is a separate matter from a fake. An invented fee on a lookalike site is different: it is a sign the site is not the operator's.
Check the contract address before you approve anything
A username gets you to the right bot. The transaction you sign is what actually moves or approves funds. Those are two separate links in the chain, and only the second one touches your wallet. A perfect handle match still means nothing if the approval behind it points at an address nobody has checked.
Where to find the address
When a bot publishes a contract address, it sits in the documentation, usually near the fee or router section, and sometimes on the website as well. Copy it from there. Never take an address from a group comment, a reply under a support question, a screenshot or a forwarded message.
Compare it, then read the approval
Paste the documented address into a block explorer for the right chain, such as Etherscan for Ethereum, Solscan for Solana or BscScan for BNB Chain, with the matching explorer for other networks. Then look at the prompt in your wallet before you confirm:
- Spender: does this address match the documented one, in full, not just the first and last characters?
- Token and amount: which asset is being approved, and is the allowance capped or unlimited?
- Contract: is this the router or token contract you expected, on the chain you expected?
An unlimited approval to an address you have not checked is the point of no return in most of these cases. Once it is signed, that address can move the approved token balance until you revoke it, and no further confirmation is needed.
Why this matters more than the seed phrase
A wallet connection or a token approval you sign yourself is how funds can leave a wallet without anyone learning a seed phrase. The signature is yours, and the bot never has to ask for a secret to get it.
None of the above is financial, legal or tax advice.
Traces a real product leaves
A genuine bot leaves a record. Not a promise, not a landing page, but things that took time to build and would be tedious to fake.
The traces to look for
- Documentation that changes. Pages with recent additions, new chains, updated limits. A static page written once and never touched is a brochure.
- A support channel with visible history. Not just a link, but messages from months back, questions answered, complaints left in place.
- A public channel with a steady posting record. Regular posts over a long stretch, including quiet periods.
- A fee structure on the operator's own pages. Banana Gun states a 0.5% Ethereum trade fee on bananagun.io; Maestro states a 1% trade fee across supported chains in its docs; Trojan states a 1% Solana fee in its FAQs. The number lives with the operator, in writing.
Why these are evidence, not a safety certificate
Each trace shows a product that has existed and answered for itself over time. Someone had to keep the docs current, staff the support channel and publish the fee. That is evidence of an operator. It is not proof that the bot is safe, well built or right for you. A long history sits alongside the handle check, the docs check and the contract check. It does not replace any of them.
Where the traces are missing
A brand new account carrying an old-looking name gives you nothing. There is no posting history to read, no support thread, no record to compare against. The same applies to a handle that appeared last week and claims to be a two-year-old product.
The fee is an identity check too
If a site quotes a fee the bot's own documentation does not support, that site is not the operator's. Check the number against the docs before you trust the rest of the page. Take a stated 0% Solana fee on Sigma: it is published at docs.sigma.win, so anything else is someone's version of it.
Traces support the chain. They do not carry it alone.
What a fake bot asks for and a real one never will
There is one line you never need to cross. No trading bot needs your seed phrase or private key. Not to set up, not to recover a wallet, not to "sync" anything. A message that asks for either is an attempt to take the wallet, whatever name sits above it.
The requests that end the conversation
- A seed phrase or private key, in any wording.
- A wallet connection to a separate site to "verify" or "unlock" the bot.
- Funds sent to an address to "activate" an account, a licence or a tier.
- A file to install, or a "new version" of the bot.
- A move to a "new official handle" because the old one is broken, limited or being retired.
- Help from a support account that started the conversation with you.
Each of these asks for control of your wallet, not for a trade.
Why a wallet connection is enough
A bot that holds your private key can lose your funds; that is the trade-off of importing a wallet at all. An approval you sign yourself is a second route to the same result: it can let a contract move tokens out of your wallet without anyone ever seeing a seed phrase. The signature looks routine, which is exactly why it works.
Urgency is part of the method
The DM, the deadline and the "limited upgrade" tend to arrive together, because a decision made in a hurry is the one that skips the check. If someone is pushing you to act now, that pressure is the finding, not a detail to work around. The reply is none.
The check happens before you connect, not after. Once a seed phrase is shared or an approval is signed, the funds leave and the conversation is over. Nothing here is financial advice, and trading memecoins can lose all of the money put in.
The check, in one place
Answer these in order. Each one is a yes or no, and you do not move to the next until the previous one is a yes.
- Did I find the website myself? A domain you typed or chose from a source you trust, not a link pasted into a DM, a group comment or an ad.
- Does the site link to its own documentation? On its own domain, reachable from the page, not a Google Doc or a Notion page that anyone could copy.
- Do the docs publish a Telegram username? If they do, write it down exactly as printed.
- Does that username match the one in front of you, character by character? Underscores, capital letters, trailing "bot", doubled letters. Every character.
- Does the contract address in the docs match the one the bot asks you to approve? If the docs publish no address, this line stays unanswered, not passed.
- Does the bot's first reply stay inside what the docs describe? No seed phrase, no private key, no wallet connection to "verify" or "unlock" anything.
Any single no means stop. There is no partial pass, no "probably fine", no finishing the check later after a small test deposit. A fake only has to win one link in the chain.
If a wallet was already connected
Revoke the approvals you granted to that address, then move anything of value to a wallet the bot has never seen. After that, report the handle through Telegram.
Before your first deposit
Open the bot's own site, note the handle it publishes, then compare it with the one in front of you before you connect anything.
Browse the bots listed on BotFees at /bots with their official handles and published fees, and use them as the reference point for every comparison you make: Banana Gun (@BananaGun_bot), Bloom (@BloomSolana_bot), BONKbot (@bonkbot_bot), GMGN (@GMGN_sol_bot), Maestro (@maestro), Pepeboost (@pepeboost_sol_bot), Sigma (@Sigma_buyBot), Trojan (@solana_trojanbot) and Unibot (@unibotsniper_bot).
Frequently asked questions
How can I tell if a Telegram trading bot is fake?
Start with the handle. Open the bot's own website, copy the Telegram username from there and compare it character by character with the bot you have open. Banana Gun's site, bananagun.io, lists @BananaGun_bot; BONKbot's docs list @bonkbot_bot. Fakes swap letters, add underscores or use "support" in the name. Then read the fee documentation. Bloom's fee docs state a 1% trade fee on every supported chain, 0.9% with a referral. A bot that cannot point to a consistent fee page is a warning sign.
Is a bot with a website automatically real?
No. A clean site and a docs page are cheap to build, and copycats clone both. What matters is whether the domain is the one the bot's own team uses and whether the handle there matches the bot you are messaging. Check that the documented fee appears on that site: BONKbot's docs state a 1% Solana trade fee, and Sigma's docs state 0% on Solana and 1% on Ethereum, Base, BNB Chain, Avalanche and Unichain. Cross-check the handle in two places, and type the domain yourself rather than tapping a link in a chat.
Someone messaged me offering help with a bot. Is that normal?
No. Treat unsolicited messages about a bot as hostile until proven otherwise. Teams do not need to DM you to fix a trade, and no genuine helper needs your seed phrase, your private key or a screen share of your wallet. Impersonator bots are common, and "support" accounts copy official handles closely. If you need help, go the other way: open the bot's own website, copy the official handle from there (Banana Gun lists @BananaGun_bot, Maestro lists @maestro), and start the conversation yourself. Then block the sender.
Can a fake bot steal my funds without my seed phrase?
Yes. A seed phrase is the fastest route, but it is not the only one. A trading bot that holds your private key can lose your funds, so a fake that gets you to import a key has everything it needs. Others work through approvals: you sign a transaction that lets a contract move your tokens, and it does. Approving a swap or signing a wallet prompt you do not understand can empty a wallet without any phrase being shared. Read every wallet request before signing, and never paste a private key into a bot, a site or a form.
What should I do if I already connected my wallet?
Stop trading with that bot. Move any remaining funds to a fresh wallet you created yourself, then revoke token approvals for the addresses you interacted with, using a reputable revoker. If you handed over a seed phrase or private key, treat the old wallet as gone and never reuse it. Do not accept "recovery" offers in DMs; that is the same scam continuing. Finally, compare the handle you used with the official one published on the bot's own website, such as @BloomSolana_bot for Bloom or @bonkbot_bot for BONKbot.