Telegram trading bot security
Telegram trading bots carry real risk, and it depends on the bot. Most create a wallet inside the bot, so the bot's systems sit between you and your funds. Several well-known bots have had exploits, and the operators say they refunded users in each case below. A bot being popular does not make it low-risk.
How bots hold your keys
Many bots generate a trading wallet for you. Banana Gun says users create a wallet in the bot or import one, and that the key is shown once. Maestro's terms say the bot must have access to, and retains, users' private keys to execute trades, while saying it does not take custody of assets. BONKbot's terms say the operator has no custody or access to credentials, and describe a remote signer that only approves transactions matching templates the user approved.
Labels such as non-custodial describe what a bot's terms say, not what its code does. Read how the wallet is created and whether you can export the key.
Documented incidents
Maestro, October 2023: an attacker used a flaw in its Router 2 contract on Ethereum to drain about 280 ETH from 106 addresses. Maestro said wallets were not compromised and refunded users, committing 610 ETH (Cointelegraph).
Unibot, October 2023: a newly deployed router lacked input validation, letting an attacker move tokens that users had approved to it. Losses were about $560K to $640K on Ethereum, per Revoke.cash, and the team refunded users.
Banana Gun, September 2024: about $3M was taken from 11 users. Banana Gun traced it to a vulnerability in the Telegram message oracle it used, paused its bots, added a two-hour transfer delay and 2FA for transfers, and refunded users from its treasury (The Block). The cause comes from the company's own post-mortem.
BONKbot, March 2024: about $523K was drained from 302 wallets. BONKbot denied a breach and said every drained account had earlier exported its private key, pointing to a third-party app (Decrypt).
Practical precautions
Fund a bot wallet with only what you are ready to lose, and move profits out. Turn on any 2FA or transfer delay the bot offers. Do not import a seed phrase or a main-wallet key into a bot. On EVM bots, review and revoke token approvals you gave to bot contracts.
Use only the bot handle linked from the project's official site, because fake bots copy real names. Never reply to private messages offering support. No bot, and no review page, can tell you a token is safe to buy. This is general information, not financial advice.
Where this shows up
- Banana Gun — Traders sniping new launches on Ethereum and other EVM chains who also want a Solana bot and a web terminal under one account.
- Maestro — Traders who want one Telegram bot for sniping and copy trading across many EVM chains plus Solana, Tron and TON.
- Unibot — EVM traders on Ethereum, Base or Arbitrum who want a long-running Telegram bot with a matching web terminal.
- BONKbot — Solana traders who want a simple Telegram bot linked to the BONK ecosystem, with a web terminal option.
- Trojan — Solana memecoin traders outside the US and EU who want one account across a Telegram bot and a web terminal.
Sources
Last checked . Fees and terms change often; the venue's own page wins if it disagrees with ours.
- Banana Gun promises to refund $3 million stolen from impacted users (The Block) — checked 2026-10-17
- Telegram Maestro bot refund of 610 ETH (Cointelegraph) — checked 2026-10-17
- Unibot exploit (Revoke.cash) — checked 2026-10-17
- Solana wallets drained, BONKbot denies link (Decrypt) — checked 2026-10-17
- Terms of Service (BONKbot) — checked 2026-10-17