Trojan is a legitimate Solana trading bot with no confirmed platform hack, but it carries the normal hot-wallet risks plus a few you should know before depositing. Its wallets are exportable and non-custodial, and it has a Secure Action Password for withdrawals. The caveats: its terms exclude US users and cap the operator's liability at HK$1,000, and fake Trojan bots and links are the most likely way a Trojan user loses money.
Risk notice: Crypto trading is high risk and memecoins can go to zero in minutes. Trading bots use hot wallets. This page is not financial advice; only trade what you can afford to lose.
Facts on this page were checked October 16, 2026. For fees and features, see our full Trojan review.
What we checked
| Check | What we found |
|---|---|
| Operator | ChainSpark Foundation, a not-for-profit foundation; terms governed by Hong Kong law (Trojan terms) |
| History | Began as a rebrand of Unibot on Solana (CoinGecko); about $228 million in lifetime fees (DefiLlama) |
| Custody | Exportable, encrypted keys in Telegram; self-custody Privy wallets on web (Trojan docs, trojan.com) |
| Known incidents | No confirmed platform exploit found (Helius hack list) |
| Audits | No public third-party security audit found |
| US access | Not allowed under its terms |
| Phishing risk | High: many look-alike Telegram bots |
Who runs Trojan?
Trojan's terms of use, last updated September 27, 2025, name the operator as the ChainSpark Foundation, described as "a not-for-profit foundation." They don't say where it is registered, but disputes go to arbitration in Hong Kong under Hong Kong law. Trojan's docs and site don't name individual founders.
CoinGecko says "Trojan originated as a rebranding of Unibot on Solana." Usage has fallen from its peak: DefiLlama shows about $1.0 million in 30-day fees against roughly $228 million lifetime (DefiLlama, checked October 16, 2026). A long record and large fee history make it a real business, not a fly-by-night bot. An anonymous team and a foundation with no stated location do mean you have little recourse if something goes wrong.
Custody: who controls your funds?
Trojan's docs say "users have access to the private keys of their Trojan on Solana generated trading wallets," that keys are "encrypted using industry standard encryption," and that you can export a wallet under Settings → Wallets. The web terminal at trojan.com describes "true self-custody wallets" built on Privy's infrastructure.
The terms back this up from the other side: "We are not a custodian and do not keep safe your assets." They also say you "bear sole responsibility for any loss" and cap Trojan's total liability at one thousand Hong Kong dollars.
So you can leave with your keys at any time, but if your account is compromised, Trojan has said in writing that it isn't on the hook. The docs themselves say to "always treat your wallet as a hot wallet."
Security features you should turn on
- Secure Action Password (SAP). Once set, exporting your private key, withdrawing and burning tokens all require it. Trojan warns that the SAP "is not recoverable," so set a hint and store it safely.
- Sell Protection. Asks you to confirm sells of more than 75% of a position, which stops fat-finger dumps.
- Scam token warnings. The bot flags tokens you didn't buy in the bot, a common sign of a scam airdrop.
- MEV protection. Keeps buys and sells private from sandwich bots, set separately for each (how MEV protection works).
Trojan's docs don't mention two-factor authentication, so your Telegram account's own two-step verification is your main login protection. Turn it on before depositing.
The US restriction
This one surprises people. Trojan's terms list as a Restricted Person anyone who is a "resident of, located in, or a citizen of the United States," and prohibit use of the Trojan functionality by any Restricted Person. If you're in the US, using Trojan breaks its terms, and combined with the HK$1,000 liability cap, you would have very weak standing in any dispute. US traders should read the terms of whichever bot they use; for example, FOMO's terms name a US company, FOMO Labs, Inc.
Fake Trojan bots and links
Trojan's popularity makes it a phishing target. CoinGecko warns against searching for the bot on Telegram because of "many spam bots and accounts with similar names."
Trojan publishes its real bots at trojanonsolana.com/links and says to "bookmark this page to avoid phishing scams." The main bot is @solana_trojanbot, and the backups use Greek-hero names such as @achilles_trojanbot and @odysseus_trojanbot, all sharing the same wallets and settings. Any other "Trojan" bot is not on Trojan's list.
The wider pattern on Solana: the March 2024 drain of about 302 wallets hit users who had exported bot keys and imported them into another app. Never paste your Trojan key anywhere that asks for it to "verify" or "claim."
Safety checklist for Trojan
- Open the bot only from trojanonsolana.com/links, bookmarked.
- Turn on Telegram two-step verification and set a Trojan SAP with a hint.
- Use a dedicated trading wallet with a balance you'd accept losing.
- Export your key once, store it offline, and don't import it into other trading apps.
- Ignore DMs from "Trojan support." Use the support group linked from the official links page.
- Turn on MEV protection and Sell Protection.
- Withdraw profits regularly to a wallet the bot doesn't control.
Account hardening for every bot is in Telegram trading bot security, and broader risks in are Solana trading bots safe?
Our verdict
Our editorial view: Trojan is legit and one of the better-designed Telegram bots for security, with exportable keys, a Secure Action Password and no confirmed platform exploit. That's why its security sub-score in our method is 9.0 and it scores 7.0/10 overall. The risks are the ones you control (fake bots, leaked keys, oversized balances) plus two you don't: an operator with minimal liability and terms that shut out US users.
If those terms rule Trojan out, compare options in Trojan alternatives or Axiom vs Trojan, and see the safest Solana trading bots ranked on security. To set it up, follow how to use Trojan bot.
