Is it safe to use a Telegram trading bot?
A Telegram trading bot carries documented risks, not unknown ones: how safe it is depends on who keeps the keys and on what happens when something breaks. Maestro, Banana Gun and GMGN have all had incidents and refunded affected users, at their own discretion. Here is how to read a bot’s custody model, spot a fake bot and limit what you can lose.
- Is it safe?
- Documented risksIncidents at Maestro, Banana Gun and GMGN are on record, each with a source
- 2FA to withdraw
- BONKbot onlyThe one bot in our set that documents 2FA or a passkey for key exports and withdrawals
- Refunds
- DiscretionaryDecided after the fact; no terms we could check promise one
- Who holds the key
- Varies by botExportable, shown at creation, sealed in hardware or hashed on the bot’s servers. What a bot holds
- Fake bots
- Look-alike handlesRaybot publishes the list of its 34 bots to check a handle against. Spot a fake
- Banana Gun drain
- About $3MSeptember 2024, through its Telegram bot; affected users refunded. See the record
- Your Telegram account
- The front doorIn most cases the bot is bound to your chat, not to a password. Lock it down
Checked 22 October 2026
On this page6
What a Telegram trading bot actually holds
Every bot in our set carries a custody field on its card, and it is the first one worth reading: who holds the key, and can you export it? Four answers come up.
- Non-custodial wallets
GMGN, Trojan and copyfomo document private-key export. Sigma documents per-chain wallets.
- Shown at creation
Maestro encrypts keys with AES and shows key and mnemonic at creation. Bloom shows the key once: delete that message and the wallet is lost.
- Sealed in hardware
BONKbot seals keys in a hardware-backed key manager (TPM 2.0, secure boot) and requires 2FA or a passkey to export a key or withdraw.
- Hashed on its servers
Based Bot holds your key hashed and ties it to your Telegram account: a single point of failure, though key export is available.
How to avoid fake Telegram bots
A fake bot does not break any cryptography. It needs you to send a seed phrase, a key or a deposit to the wrong chat, and the cheapest way there is a handle that is almost right.
- Open the tool’s card and note its official domain and Telegram handle before anything else.
- Start from the documented link, never from a handle pasted into a chat, a group or a screenshot.
- Compare the handle character by character: @gmgnaibot, @Maestro, @solana_trojanbot, @BloomSolana_bot, @bonkbot_bot, @BananaGun_Bot, @BananaGunSniper_bot, @copyfomo_bot and @sigma_buybot are the documented ones.
- For a wallet tracker: @Wallet_tracker_solana_spybot, @EVMTrackerBot, or a Raybot checked against its published list of 34 bots.
Is it safe to use a Telegram trading bot? What the record shows
Incidents are documented, and not only at obscure tools. Each one below is sourced on the tool’s card.
- Oct 2023Maestro Router 2 exploitAbout $500K on Ethereum. Maestro refunded about 610 ETH to affected users.
- Sep 2024Banana Gun compromisedUnauthorized withdrawals through the Telegram bot drained about $3M from user wallets. Affected users were refunded.
- Oct 2025MEV attack at GMGNA sandwich attack hit user trades despite anti-MEV settings. GMGN reported full compensation.
- Feb 2026Allegations at AxiomAn on-chain investigator published insider-trading allegations involving staff. No user funds were reported lost.
Two lessons
- The operator, not the chain
The failure usually sat with the operator or the execution path, not with the blockchain.
- Refunds are discretionary
Each loss above was paid back, but by a decision taken after the fact, not under any terms we could check.
Use a dedicated wallet, funded with a small amount
A trading bot only needs the money you plan to trade. The documented losses were measured in the balance of the wallets connected to the bot: a dedicated wallet, funded in small amounts, separates a bad day from a bad year.
- Create a wallet for bot trading only, and export its key to a place you control as soon as it is created.
- Fund it with what you are prepared to trade that month, not with your holdings.
- Withdraw profits out of the bot wallet instead of letting the balance grow inside it.
- Keep the wallet that stores your assets out of every bot, tracker and browser extension.
Passwords, 2FA and the account behind the bot
In our set, only BONKbot documents 2FA or a passkey at the point that matters: key exports and withdrawals. Everywhere else the protection is yours, and your Telegram account is the front door to every bot you use.
Lock the front door
- Two-step verification
Turn on Telegram’s own: in most cases the bot is bound to your chat, not to a password.
- A clean session list
Review your active sessions and end any you do not recognize.
- New device logins
Treat each one as an event worth checking.
Red flags to check before you deposit
None of the gaps below makes a tool malicious. Together, they are a good reason to start with an amount you can afford to lose.
Tick each box before you deposit
A fee schedule and public docs. Terminal states only a ceiling of up to 1% a trade and up to 35% cashback without tiers, and its docs domain redirects to the app.
A documented custody model. Terminal and Bankr leave the key question open.
Published referral terms. GMGN publishes no discount for referred users, and Banana Gun publishes no rate at all.
Docs that agree with themselves. Axiom’s FAQ says Solana only while its app trades on eight chains; Sigma and Bloom list different chains on different pages.
Official accounts that exist. Sigma’s documentation cites an X account that does not resolve.
Usage data that adds up. DefiLlama shows Banana Gun at $1.51K over 30 days against $911K over a year, which looks like a broken tracker rather than a collapse in activity.
What failed, how much was lost, and what users got back. The DegenBench Hack Register records the security incidents at crypto trading bots, terminals and AI agents, source by source.
Tools used in this guide
BONKbot
Telegram bot + Telemetry web app · Solana
You are new to bots and want a simple Telegram flow with strong key security.
- Platform fee
- 1%
- Where it runs
- Telegram, Web
- Referral perk
- None documented
GMGN
Web terminal + Telegram bots · Solana · EVM · Tron
You trade memecoins on several chains and want analysis and execution in one place.
- Platform fee
- 1%
- Where it runs
- Web, Telegram
- Referral perk
- None documented
DefiLlama, 30 days, all chains: about 55% of fees on EVM chains.
Banana Gun
Multi-chain Telegram bot + Banana Pro web · Solana · EVM
You trade Ethereum, Base or BSC launches from Telegram and want the lowest documented manual-trade fee.
- Platform fee
- 0.5% / 1%
- Where it runs
- Telegram, Web
- Referral perk
- None documented
DefiLlama shows $1.51K over 30 days against $911K over the past year: its tracker looks broken, so this card number understates real use.
Maestro
Multi-chain Telegram bot · Solana · EVM · Tron · TON
You want one Telegram bot for Solana plus EVM chains, TON and Tron.
- Platform fee
- 1%
- Where it runs
- Telegram, Desktop app
- Referral perk
- None documented
DefiLlama, 30 days, all chains: about 53% of fees on EVM chains.
Frequently asked questions
Is it safe to use a Telegram trading bot?
It carries documented risks rather than unknown ones. Maestro, Banana Gun and GMGN have all had incidents, and all three refunded affected users. Read the custody model before you deposit: GMGN, Trojan and copyfomo document key export, Maestro shows the key at creation and Bloom only once, and BONKbot documents 2FA or passkey on exports and withdrawals.
How do I spot a fake Telegram trading bot?
Check the handle against the tool’s own documentation and the domain against its card, then open the bot from the documented link yourself. Raybot runs 34 look-alike bots and publishes their list to check a handle against. A handle that arrived in a message is not a verified handle, however convincing the chat looks.
Do Telegram bots keep my private keys?
It depends on the model, and the tools state it. GMGN, Trojan and copyfomo document non-custodial wallets with key export, and Sigma documents per-chain non-custodial wallets. Maestro stores AES-encrypted keys and shows the key and mnemonic at creation; Bloom shows the key once. fomo lets you export its wallet’s key from the settings; Terminal and Bankr do not document the answer.
Which Telegram trading bots have had security incidents?
Maestro had a router exploit in October 2023 worth about $500K, and refunded about 610 ETH. Banana Gun was compromised in September 2024, when unauthorized withdrawals drained about $3M from user wallets before refunds. GMGN users were hit by an MEV sandwich in October 2025 and were compensated. Each is documented with a source on its card.
Should I use my main wallet with a Telegram bot?
No good reason to. A bot only needs the funds you are actively trading, and the documented incidents were measured in the balance of the wallets connected to the bot. Create a wallet for that purpose, export its key when you create it, fund it in small amounts and withdraw profits instead of leaving them inside.
Do I need 2FA on Telegram to trade with a bot?
BONKbot is the only tool in our set that documents 2FA or a passkey as a requirement for key exports and withdrawals. Everywhere else, the layer is yours to add: enable Telegram’s own two-step verification and review active sessions, because a bot is usually bound to your account and chat rather than to a separate password.