BONKbot is a legitimate Solana Telegram trading bot, and no exploit of BONKbot itself has been confirmed as of October 2026. The real risks are a hot wallet that lives inside your Telegram account, a 2024 wallet drain linked to exported BONKbot keys, an operator that names no company, and fake BONKbot bots.
Risk notice: Crypto trading is high risk and memecoins can go to zero in minutes. Trading bots and wallet connections use hot wallets. This page is not financial advice; only trade what you can afford to lose.
Facts on this page were checked October 23, 2026, from BONKbot's own docs and the sources linked below. This is a research-based review built from published docs, not a hands-on trial. For fees and features, see the full BONKbot review.
What we checked
| Check | What we found |
|---|---|
| Company/team | No legal entity named on bonkbot.io or its docs; the site footer just says "Bonkbot © 2026" |
| Custody | Bot-generated wallet in Telegram with seed phrase export; Telemetry claims a "non-custodial architecture" (Telemetry) |
| Known incidents | March 2024 drain of about 302 wallets, 113 of them BONKbot users; BONKbot denied a breach (Decrypt) |
| Audits | No public third-party security audit found |
| Phishing risk | Medium to high: fake Telegram bots and look-alike channels are common across trading bots |
Who runs BONKbot?
BONKbot is one of the original Solana Telegram bots and is closely associated with the BONK community; CoinGecko reported in 2025 that 10% of its fees buy and burn BONK, though the current docs don't confirm it. Its fee page states a flat 1% on each successful swap.
What it does not publish: a company name, a jurisdiction or named founders. The homepage lists "Terms of Service" and "Docs" in its footer, but the only operator text visible is "Bonkbot © 2026." That is a transparency gap compared with FOMO (FOMO Labs, Inc.) or Axiom (a YC company with named founders). If something goes wrong, you have less to go on.
Usage has shrunk. DefiLlama showed about $118,000 in 30-day fees for the Telegram bot when our review checked it in September 2026 (DefiLlama). Low usage isn't a security flaw, but smaller bots are more likely to be sold or shut down, which our are Solana trading bots safe? guide covers.
Custody: who controls your funds?
When you start BONKbot, it creates a Solana wallet for you inside the Telegram chat. You deposit SOL to that address and the bot signs trades from it. You can export the wallet's seed phrase from the Wallet menu, as Sol Incinerator's BONKbot guide shows, so you can recover funds in a normal wallet if the bot disappears.
For the newer Telemetry web terminal, the Telemetry site claims a "non-custodial architecture," "passkey integration" and a "custom TPM + HSM architecture." The BONKbot docs repeat "Non-custodial architecture" and "End-to-end encryption" but give no technical detail, and no audit backs these claims.
What this means in practice:
- Anyone who controls your Telegram account can trade and withdraw. The bot trusts the chat, so your Telegram login is effectively your wallet password.
- The exported seed phrase is a second key. Every place you store or import it is another place it can leak.
- The bot's servers sign for you. That is how every Telegram bot works, and it is why you should only keep a trading balance there.
The March 2024 wallet drain
On March 29, 2024, about 302 Solana wallets were drained of roughly $523,000. Decrypt reported that 113 of the victims had used BONKbot. A Dogecoin developer told users to withdraw from the bot, per CoinGape.
BONKbot's response was that "every user account being drained has previously exported their private keys," and that users who had never exported were safe. In other words, it blamed another app the keys had been imported into, not its own systems. A rival bot, Solareum, shut down after its own breach around the same time (Helius).
How to read this:
- No public post-mortem proved a BONKbot breach. The link is disputed, and BONKbot's explanation fits the evidence it described.
- It is still the clearest lesson about bot wallets. Exporting a key and pasting it into an untrusted tool is one of the fastest ways to lose a bot wallet.
- In our method, this counts as a disputed incident, which puts BONKbot's security sub-score at 8.5 rather than the 9.0 starting value.
The 2026 BONK treasury drain was not BONKbot
In July 2026, more than 4.4 trillion BONK (about $20 million) left the BonkDAO treasury after a malicious governance proposal passed, according to Decrypt. BonkDAO said law enforcement had been notified. Decrypt's report does not mention BONKbot, and it describes a DAO governance attack, not a compromise of trading-bot wallets. If you see posts claiming "BONKbot got hacked" from that week, check the source; they may be confusing the two, or using the news as bait for a fake "migrate your wallet" bot.
Fake BONKbot bots and channels
Telegram bots are easy to clone. A copy can use the same name, logo and menu layout, then ask you to "import your wallet" or "verify" with a seed phrase. Kaspersky's 2025 review of Telegram scams documents fake bots and crypto lures of exactly this kind (Kaspersky).
Warning signs:
- A BONKbot that asks for a seed phrase or private key. The real bot creates a wallet for you; it never needs your other wallets' keys.
- A "support" account that DMs you first. BONKbot's docs point to support via its Discord or Telegram, not unsolicited DMs.
- Links from replies, group chats or ads instead of from bonkbot.io.
- A "new version" or "migration" bot after news about BONK, Telemetry or a hack.
Safety checklist for BONKbot
- Open the bot only from a link on bonkbot.io and check the username matches before you press Start.
- Turn on Telegram two-step verification and review active sessions in Telegram settings. See Telegram trading bot security.
- Keep a small trading balance and withdraw profits to a wallet you control.
- Export the seed phrase once and store it offline. Don't keep it in screenshots, notes apps or cloud drives.
- Don't import the BONKbot key into other bots, extensions or "tools." That is what BONKbot said the 2024 victims did.
- Never share the key with support. No legitimate team needs it.
- Turn on MEV protection and set sensible slippage (MEV protection explained).
- Make a test withdrawal right after your first deposit.
Setup screens are in how to use BONKbot. If your bot wallet does get drained, follow Solana wallet drained: what to do.
Our verdict
Our editorial view: BONKbot is legit and acceptable for small, active balances. Its own record is clean apart from the disputed 2024 drain, and you can export your key. Against it: no named company, no audit, thin technical detail on key storage and shrinking usage. BONKbot scores 6.8/10 in our ranking.
If you want a bot with a named team and more tools, compare Trojan vs BONKbot, read is Trojan safe?, or see the safest Solana trading bot ranking and BONKbot alternatives.
