Trading bot risks: hacks, keys and approvals
Telegram trading bots are convenient because they hold a wallet for you, and that is exactly the risk. Maestro, Unibot, Banana Gun, Solareum and DEXX have all lost user funds to exploits since 2023. Read how it happens and how to limit the damage before you deposit.
Why trading bots are a target
A Telegram trading bot is fast because it trades for you without asking each time. To do that, it holds a wallet with your funds, usually by keeping the private key on its own servers, and often has token approvals that let its contracts move your tokens. Whoever breaks the bot's servers, its contracts or its message handling can move the money in every wallet it controls.
This is not theoretical. Below are real incidents involving Telegram trading bots, with sources.
Real incidents
| Date | Bot | What happened | Reported loss | Users refunded? |
|---|---|---|---|---|
| Oct 2023 | Maestro | A flaw in a newly released router contract let anyone make it move tokens that users had approved | about 280 ETH (around $500K) | Yes, Maestro repaid affected wallets |
| Oct 31, 2023 | Unibot | A token approval exploit in its new router contract | about 355 ETH (around $600K to $640K) | Unibot said it would compensate users |
| Late Mar 2024 | Solareum (Solana) | Wallets that had exported their private keys were drained; the bot shut down | about $523K | No compensation reported |
| Sep 19, 2024 | Banana Gun | A suspected flaw in the Telegram message oracle let an attacker move ETH from wallets while the bots were running | about $3M (first reported as 563 ETH) | Yes, from the Banana Gun treasury |
| Nov 16, 2024 | DEXX | Private keys were stored without proper protection and leaked | estimates from $13M to about $30M | No significant recovery reported |
The main ways money is lost
1. The bot's servers are breached. Most bots generate and store the private key of the wallet they give you. If those keys leak (DEXX) or an attacker can send signed actions through the bot (Banana Gun), your wallet can be emptied without you doing anything.
2. A smart contract has a bug. Bots route trades through their own contracts. When you approve a token, that contract may move it. A new router with a flaw can turn every approval into an open door (Maestro, Unibot).
3. Exported or imported keys. Exporting your bot wallet's key to another app, or importing your main wallet's key into a bot, puts the same key in more places. In the Solareum case every drained wallet had exported its key.
4. Fake bots and fake admins. Impersonator bots copy names and profile pictures and ask you to connect a wallet or paste a seed phrase. Fake "support admins" contact you in private messages. A real bot never needs your seed phrase.
5. The bot shuts down. A small team can stop operating after an exploit or when money runs out. Funds left in its wallets may be stuck or lost.
How to limit the damage
- Use a separate wallet for each bot and keep only what you trade with in it. Never import your main wallet or your long-term holdings.
- Withdraw profits regularly to a wallet the bot has never seen.
- Open bots only through their official handle. Every bot on this site links its handle with the page where the bot itself publishes it.
- Never share a seed phrase or private key, and never type it into a Telegram chat, a website from a direct message or a "verification" bot.
- Review and revoke old token approvals with a tool such as revoke.cash, especially after a bot announces a new router.
- Prefer bots that have refunded users after past incidents and publish a post-mortem, and watch their official channels after an incident before you deposit again.
- Assume every bot can lose funds. Only deposit what you can afford to lose.
Sources
- Banana Gun: The Block, Cointelegraph
- Maestro: Decrypt, Revoke.cash
- Unibot: Revoke.cash, BeInCrypto
- Maestro and Unibot together: CertiK
- Solareum: Decrypt, Cointelegraph
- DEXX: Cointelegraph, BitDegree
This page is general information, not financial advice.