Is it safe to use a Telegram trading bot?

What a Telegram trading bot actually holds

Every bot in our set carries a custody field on its card, and it is the first field worth reading. The non-custodial family gives you a key you can export: GMGN, Trojan and copyfomo document private-key export, and Sigma documents per-chain non-custodial wallets.

A second family generates a bot wallet and shows the key once, in the Telegram chat itself: Maestro encrypts private keys with AES and displays the key and mnemonic at creation, and Bloom shows the private key once and warns that deleting that message means losing the wallet.

BONKbot documents the most detailed setup of the group: keys sealed in a hardware-backed key manager using TPM 2.0 and secure boot, with 2FA or a passkey required to export a key or withdraw.

Based Bot documents a harder middle ground: it holds your private key hashed on its servers and ties it to your Telegram account, which its own card calls a single point of failure, even though key export is available.

The remaining pattern is silence. Terminal’s custody model is simply not documented, Bankr states that key export is not documented, and fomo’s embedded wallet has no documented export either. Silence is not automatically bad; it is a reason to keep less money in the wallet.

How to avoid fake Telegram bots

A fake bot does not need to break cryptography. It needs you to type a seed phrase, a key or a deposit into the wrong chat, and the cheapest way to make that happen is a handle that is almost right.

Ray documents this problem directly: look-alike Ray bots exist, and its card asks users to use @ray_purple_bot. That warning generalises. Verify the handle against the tool’s own documentation and the domain against the card, then start the conversation yourself from the documented link instead of accepting a handle you were given.

Documentation you cannot verify is a warning of its own. Sigma’s documentation cites an X account that does not resolve, and Axiom’s docs disagree about which chains it supports — Solana only in the FAQ, Solana, BSC and Ethereum elsewhere. If the official material is inconsistent, the unofficial material around it is worse.

1. Open the tool’s card and note the official domain and the official Telegram handle before anything else.
2. Start from the documented link, never from a handle pasted into a chat, a group or a screenshot.
3. Compare the handle character by character: @gmgnaibot, @Maestro, @solana_trojanbot, @BloomSolana_bot, @bonkbot_bot, @BananaGunSniper_bot, @copyfomo_bot and @sigma_buybot are the documented ones for the bots in this guide.
4. If a wallet tracker is what you need, the documented handles are @Wallet_tracker_solana_spybot, @EVMTrackerBot and @ray_purple_bot.
5. Treat any request for your existing wallet’s seed phrase as the end of the conversation.

Is it safe to use a Telegram trading bot? What the record shows

Incidents are documented, and they are not limited to obscure tools. Maestro suffered a Router 2 exploit on Ethereum in October 2023, worth about $500K, and refunded about 610 ETH to affected users. Banana Gun was compromised in September 2024: unauthorized withdrawals drained about $3M from user wallets through the Telegram bot, and affected users were refunded.

More recently, GMGN users were hit by an MEV sandwich attack in October 2025 despite anti-MEV settings, and GMGN reported full compensation. Axiom had insider-trading allegations involving staff published in February 2026 by an on-chain investigator, with no user funds reported lost.

Two useful conclusions follow. First, the failure mode is usually the operator or the execution path, not the blockchain. Second, refunds happened in each of those cases, but a refund is a discretionary decision taken after the fact, not a guarantee written into any terms we could check.

Use a dedicated wallet, funded with a small amount

A trading bot only needs the money you intend to trade with. Keeping that in a wallet created for the bot, funded in small increments, separates a bad day from a bad year — and it matches how the incidents above actually played out, with losses measured in the balance of the wallets connected to the bot.

The custody model tells you how much separation you get for free. With a non-custodial setup such as GMGN, Trojan, copyfomo or Sigma, the key is exportable and the wallet is yours to move. With a bot wallet such as Maestro’s or Bloom’s, the key is shown once: lose that message and the wallet is gone, which is another reason not to make it your main address.

1. Create a wallet specifically for bot trading, and export its key to a place you control at the moment of creation.
2. Fund it with what you are prepared to trade that month, not with your holdings.
3. Withdraw profits out of the bot wallet instead of letting the balance grow inside it.
4. Keep the wallet you use to store assets out of every bot, tracker and browser extension.

Passwords, 2FA and the account behind the bot

Only one tool in our set documents 2FA or passkey enforcement at the point that matters: BONKbot requires it for key exports and withdrawals, on top of hardware-sealed keys. Maestro documents AES encryption of private keys, and Bloom shows the key a single time.

Where a tool does not document that layer, the protection is yours to provide. Your Telegram account is the front door to every bot you use, because in most cases the bot is bound to your chat rather than to a password. Enable Telegram’s own two-step verification, keep the session list clean, and treat a new device login as an event worth checking.

This is also why the fabricated-bot risk is not purely about crypto. A convincing fake in the right chat is close enough to the real bot to ask for something the real bot would never need.

Red flags to check before you deposit

No published fee: Terminal advertises up to 35% cashback without publishing the fee it applies to, and fomo shows the cost per swap without a public schedule. No public documentation: Terminal’s docs domain redirects to the app itself.

No documented custody: Terminal, Bankr and fomo all leave the key question open. No documented referral terms: GMGN publishes no discount for referred users, and Banana Gun publishes no rate at all.

Documentation that contradicts itself: Axiom’s FAQ and its chain list disagree, Sigma lists different chains on different pages, Bloom’s chain list varies between official pages, and Cielo’s docs still show lower plan limits than its homepage.

Usage data that does not add up: DefiLlama shows Banana Gun at $7.2K over 30 days against $2.7M over a year, which looks like a broken tracker rather than a collapse in activity. None of these points makes a tool malicious, and together they are a good reason to start with an amount you can afford to lose.