Are Telegram Trading Bots Safe? Risks, Hacks, Checklist

Telegram trading bots can be used safely, but none is risk-free. Safety comes down to where your private key lives, who can sign with it, and how the operator handles a failure. Since 2023, users have lost funds to bot contract bugs, leaked keys and fake look-alike bots. Use a burner wallet and the checklist below.

This page is written as of October 2026. It names real incidents with dates and outcomes, because outcomes matter as much as the hack: some operators refunded every user, others shut down. It does not rate any named bot as unsafe today.

Are Telegram trading bots legit?

The well-known ones are real products with real users, and most are free to start with a fee taken on each trade. "Legit" is not the same as "risk-free", though. A legitimate, well-run bot can still ship a bug, and the more popular a bot gets, the more scammers copy its name. The useful questions are structural: where is the key, who can sign, what protections can you switch on, and what happened the last time something broke.

Where your key lives: three models

Every trading bot needs a key that can sign transactions for the wallet it trades from. What differs is where that key sits, and that decides what can go wrong.

The embedded model deserves a note because it is often misread. Privy, for example, documents that private keys are split into encrypted shares and only exist in complete form inside a trusted execution environment while a signature is made (Privy architecture docs). Turnkey describes key generation and signing inside secure enclaves (Turnkey security docs). That shrinks the key-theft surface. It does not remove the need to protect whatever account is allowed to ask for a signature.

None of the three is automatically safe. Each one moves the risk somewhere different, which is why the rest of this page is about failure modes rather than brand names. For a deeper look at the hosted versus self-hosted trade-off, see why PumpStriker is self-hosted instead of SaaS.

Dated incident timeline

Four incidents show the main ways bot users have lost funds. Each row is sourced; dollar figures are as reported at the time.

Two patterns stand out. Every incident hit something the operator ran: a router contract, keys users had imported into the bot, a message oracle, a key server. And the outcome for users depended entirely on the operator. Maestro and Banana Gun refunded; Solareum shut down; DEXX tied compensation to recovery. Our breakdown of the Maestro router exploit and self-custody goes deeper on why a good refund still means a bad day.

Fake bots and impersonators

Plenty of losses never involve the real bot at all. A Telegram display name is free text; only the exact @username identifies a bot, and look-alike handles are cheap to register. Three patterns are worth knowing:

• Fake verification bots. In December 2024, Scam Sniffer warned about fake X accounts that pushed people into Telegram groups guarded by a fake Safeguard verification bot, OfficiaISafeguardBot, whose handle swaps the lowercase l in "Official" for a capital I. It led users to run malicious PowerShell code that downloaded malware, and Scam Sniffer linked similar malware to private key theft (Cointelegraph, Dec 11, 2024).
• Fake open-source bots. In July 2025, SlowMist traced stolen funds to a GitHub repository posing as a Solana pump.fun bot, whose dependency uploaded private keys to a remote server (Cointelegraph, July 4, 2025). Our open-source bot audit guide covers the red flags.
• Poisoned libraries. On December 3, 2024, two versions of the @solana/web3.js package, 1.95.6 and 1.95.7, were published with code that stole private keys from apps that handle keys directly, such as bots (Solana web3.js advisory). This one hits self-hosted bots too.

🚨 No legitimate bot needs your seed phrase, and no legitimate group makes you run a command to "verify" you are human. Treat urgent DMs from "support" or "devs" as scams by default.

A 7-point safety checklist for any Telegram trading bot

1. Start from the official website. Open the bot from the link on the operator's own site and compare the exact @username before you tap Start.
2. Use a dedicated trading wallet. Fund it with only what you can afford to lose and sweep profits to a wallet the bot never sees.
3. Know where the key lives. Hosted, embedded provider or self-hosted. Read how the key is created, encrypted and exported before you deposit.
4. Switch on every guard. Passcodes, two-factor authentication, withdrawal delays and address whitelists exist because incidents happened.
5. Never share a seed phrase or run commands from chats. A trading wallet key is all a bot ever needs, and no real verification step involves PowerShell.
6. Check the incident history. Search the bot's name with "exploit" and read how the team handled it: post-mortem, fix, refunds.
7. Audit self-hosted code before you fund it. Read the dependencies, have an AI review the repository, and run it with an empty wallet first.

The PumpStriker best-practices guide applies the same thinking to a self-hosted setup, including what to rotate after any scare.

Is Trojan safe? Is BONKbot safe?

Both are hosted Telegram bots, and this page does not rate either as unsafe. Trojan's own documentation describes it as a non-custodial platform and says its Terminal does not store or control users' funds or private keys (Trojan FAQ). BONKbot's name came up during the March 2024 drains, and BONKbot said its data pointed to Solareum, which then shut down (Decrypt).

The checklist above applies to both: official link, dedicated wallet, small balances, every protection switched on, and a clear understanding of how your key is stored and exported. For side-by-side trade-offs, see PumpStriker vs Trojan and PumpStriker vs BONKbot.

Where PumpStriker fits, including the trade-off

PumpStriker is a self-hosted Solana memecoin trading bot. It runs on your own PC or VPS, your private key is encrypted locally with AES-256-GCM and never leaves your machine, and there is no PumpStriker server in the trade path. That removes the failure mode in most of the timeline above: there is no central database of user keys to leak and no shared server to breach. The execution bot is open source under the MIT license, so you can check the key handling yourself instead of trusting this paragraph.

The trade-off is real, and it is yours to carry:

• You install it yourself. Node.js 20+, a free Telegram bot token and a free-tier Helius key, on Windows, macOS or Linux. It is not instant-on like a hosted bot.
• You secure it yourself. Your Telegram bot token is the master key to the encrypted wallet file, so anyone with the token and the file can decrypt it. Never share it, never post it.
• You harden the VPS. The dashboard has no built-in authentication, so the dashboard guide says to keep it behind a tunnel or VPN, never open to the internet.
• You watch your dependencies. Self-hosted bots inherit supply-chain risk like the web3.js incident, which is exactly why the code and lockfile are open to read.

Self-hosting also does nothing for token risk. Rug Cancel and the safety checks reduce the odds of buying a trap; they do not make memecoins safe.

Frequently asked questions

Are Telegram trading bots legit?

The well-known ones are real products with real users, and most are free to start with a fee taken on each trade. Legit is not the same as risk-free: legitimate bots have had exploits, and fake look-alike bots copy their names. Judge a bot by where your key lives and how past incidents were handled.

Is Trojan bot safe?

Trojan is a hosted Telegram bot whose documentation describes it as non-custodial. No bot is risk-free, so open it from the official link, use a dedicated wallet with money you can afford to lose, and switch on every protection it offers. This page does not rate Trojan as unsafe; it explains the trade-offs of hosted bots.

Is BONKbot safe?

BONKbot is a hosted Telegram bot. During the March 2024 wallet drains it was blamed at first, and it said its data pointed to users who had imported keys into Solareum, which then shut down. The same rules apply as for any bot: official link, dedicated wallet, small balances, and know how your key is stored.

Can a Telegram bot drain my wallet?

Any bot that can sign for a wallet can, in principle, move what is in it, whether through a bug, a breach, a malicious copy or a stolen account. That is why the location of the key matters, and why a bot wallet should only ever hold money you can afford to lose.

Is a self-hosted bot safer than a hosted one?

It removes the operator's servers from the picture, so there is no central key database to leak or breach. It moves the responsibility to you: your machine, your bot token, your dependencies. A self-hosted bot is only as safe as the setup you run it on.