Most Telegram trading bot losses don't come from the bot being hacked. They come from fake bots, phishing links, malware "verification" bots, hijacked Telegram accounts and private keys pasted into the wrong app. The fixes are simple: use official links only, turn on Telegram 2-Step Verification and bot-level 2FA, keep a small burner balance, and withdraw profits often.
Risk notice: Crypto trading is high risk and memecoins can go to zero in minutes. Trading bots use hot wallets. This page is not financial advice; only trade what you can afford to lose.
This guide covers how each attack works, documented incidents, and a setup checklist. For platform-level hacks and how we score security, see are Solana trading bots safe?. Facts checked September 26, 2026.
Why Telegram bots are a target
A Telegram trading bot holds a hot wallet and signs trades for you. That means:
- Your Telegram account is the key to the wallet. Whoever controls your Telegram session can usually trade and withdraw, unless the bot adds its own 2FA.
- Bots are easy to clone. Anyone can create a bot with a similar name and profile picture.
- The ecosystem runs on links. Callers, groups and ads push contract addresses and bot links all day, which is ideal cover for phishing.
Attack 1: Fake bots
A fake bot copies a real bot's name and look. It might ask you to "import" your wallet by pasting a seed phrase or private key, or show a deposit address the scammer controls.
What the bots say:
- GMGN lists five official Solana bots, at t.me/US_GMGNBOT (named GMGN_US), t.me/GMGN_sol_bot, t.me/GMGN_sol02_bot, t.me/GMGN_sol03_bot and t.me/GMGN_sol04_bot, and warns: "Any other bots are scammer bots which will drain your wallet" (GMGN).
- Trojan's docs: "Always use official links!" (Trojan)
- BONKbot tells users to verify the bot through official sources (BONKbot).
Defense: open bots only from the official website or docs, bookmark them, and check the exact username before every deposit. A real trading bot generates a wallet for you; it never needs your main wallet's seed phrase.
Attack 2: Malware "verification" bots
In December 2024, security firm Scam Sniffer reported a scheme combining fake X influencer accounts, fake Telegram channels and a fake "Safeguard" verification bot. Victims were told to verify, and the bot got them to run a malicious PowerShell command that installed malware to steal wallet keys (Cointelegraph).
Defense: no legitimate Telegram group needs you to paste anything into your computer's terminal, PowerShell or Run box. If a "verification" step asks you to, leave.
Attack 3: Phishing sites and approvals
Links to fake token sites, fake airdrops and fake "claim" pages trick you into signing a transaction or entering a key. In October 2025, attackers used a fake token website to trick about 107 GMGN users into authorizing transactions. GMGN said it blocked the attack and compensated users (PANews).
GMGN's safety page puts it simply: "What you see is what you sign." It recommends checking regularly for unfamiliar authorizations and revoking them, and ignoring random tokens that appear in your wallet: "Don't be curious."
Defense: don't click links in bot ads, DMs or replies. BONKbot itself warns users to "exercise extreme caution when engaging with all external links presented in BONKbot ads."
Attack 4: Fake support and admin DMs
Scammers watch public groups for people asking for help, then DM them posing as support.
- GMGN: "The official admins will not send you a private message first!!!"
- BONKbot: "BONKbot mods and admins will NEVER dm you first - anyone who does is 100% a scammer!" (BONKbot)
- BONKbot on keys: "The only reason anyone will ever ask is to steal your money."
Defense: assume every unsolicited DM is a scam. Never share a private key, seed phrase or 2FA code.
Attack 5: Account takeover
If someone logs into your Telegram, they can use your bot. Telegram's own 2-Step Verification means "you will need both an SMS code and a password to log in," which blocks SIM-swap takeovers that only get the SMS code. If your phone is lost, Telegram says to terminate the old session under Settings, Devices (Telegram FAQ).
GMGN also suggests hiding your phone number and restricting who can add you to groups.
Attack 6: Exporting keys into the wrong app
Exporting your bot's key is fine as a backup. Importing it somewhere else is where people get hurt.
- Solareum (March 2024). A Solana Telegram bot shut down after a breach drained about $523,000 from more than 300 wallets. Decrypt reported that users who had imported private keys into Solareum were affected (Decrypt). Helius put losses between $520,000 and $1.4 million (Helius).
- BONKbot link (disputed). BONKbot said every drained account in that wave "has previously exported their private keys" (Decrypt).
- DEXX (November 2024). Helius reports about $30 million lost after improper key handling exposed wallets during key exports.
Defense: store an exported key offline. Import it only into a mainstream wallet you already trust, and only when you need to move funds.
Bot-level protections to turn on
| Bot | Protection | What it covers | Source |
|---|---|---|---|
| Trojan | Secure Action Password | Required for sensitive actions like exporting keys and withdrawing; "not recoverable" | Trojan |
| BONKbot | 2FA (authenticator app) | Private key exports and withdrawals | BONKbot |
| GMGN | Telegram settings plus approval hygiene | Account takeover, phishing approvals | GMGN |
| FOMO (app, not Telegram) | Face ID | App open, withdrawals, key export | FOMO |
Setup steps are in how to use Trojan bot, how to use BONKbot and how to use GMGN.
Use a burner wallet
A burner wallet is a wallet you use only for trading. Keep your long-term holdings in a separate wallet, ideally a hardware wallet, and never connect it to trading bots or random sites. BONKbot's docs make the same point: don't send it "more money to BONKbot than you can afford to lose," and move funds back to your main wallet after trading (BONKbot).
Withdraw profits on a schedule
Bots change hands, pause or shut down: BullX paused trading in June 2026 (crypto.news) and Padre was bought by Pump.fun (Blockworks). Pick a rule, such as withdrawing anything above your trading balance at the end of each day, and stick to it. Test a small withdrawal right after your first deposit so you know it works.
Setup checklist
- Open the bot from its official site; bookmark it.
- Turn on Telegram 2-Step Verification.
- Turn on the bot's own 2FA or password.
- Export the key once; store it offline; don't import it elsewhere.
- Fund with a small amount; test a withdrawal.
- Turn on MEV protection (explained here).
- Ignore DMs, "verification" bots and unknown airdrops.
- Withdraw profits regularly.
For Telegram bot picks, see best Solana trading bots for Telegram. Our full ranking, which weights security at 25%, is on the home page.