Are Telegram trading bots safe? Keys, exploits and fake bots

Telegram trading bots are reasonably safe for small, active trading balances and a bad place to keep anything you can’t afford to lose. Every bot in this category generates a wallet, keeps its private key on the operator’s servers and signs trades for you. That makes it fast, and it also means your funds are only as safe as the team’s infrastructure and your own Telegram account.

Maestro, Unibot, Banana Gun and the DEXX web terminal have all had incidents where user funds were taken. Below is how the key model works, what happened in each case, and a checklist that caps how much you can lose.

How do Telegram trading bots handle your private keys?

When you press “generate wallet”, the bot creates a new keypair and stores the private key on its backend. When you tap “Buy”, its servers sign and broadcast the transaction. You never approve anything in a wallet app, which is exactly why bots are fast.

Compare that to MetaMask or Phantom, where the key lives on your device and every transaction waits for your click. With a bot, three parties can move your funds:

• The operator, whose servers hold the key. Maestro’s security FAQ says keys are AES-encrypted, but the bot still has to decrypt them to trade.
• Anyone who controls your Telegram account, since that account is your login to the bot.
• Anyone who gets a copy of the key, from a screenshot, your clipboard, or a message you forgot to delete.

This isn’t custody in the exchange sense: you can usually take the key and import it into your own wallet. But day to day it behaves like a hot wallet someone else runs.

Can you get your private key out?

It depends on the bot, and you need to know before you deposit:

Bot	Getting the key
Maestro	Shown once at wallet creation. You can still send funds out while the wallet is connected.
Banana Gun	Shown once at creation. Its FAQ says it cannot be retrieved later.
BullX	Shown once. Docs recommend importing it into Phantom, Solflare or Rabby.
Trojan (web terminal)	Export option in the wallet menu.

If a bot shows the key only once, write it down on paper at that moment. Maestro’s docs specifically warn against copying it to your clipboard, where clipboard-reading malware can pick it up.

What went wrong before: real bot exploits

These are the verified incidents most relevant to bot users, all reported by established crypto outlets.

When	Product	What happened	Loss	Outcome
Oct 24, 2023	Maestro	Router 2 contract let attackers call transferFrom on tokens users had approved to it	About 280 ETH	Maestro repaid users 610 ETH from its revenue
Oct 31, 2023	Unibot	Newly deployed, unverified router had a similar token-approval bug	About $640,000	Unibot promised compensation; said keys were not affected
Sep 19, 2024	Banana Gun	Attacker abused a flaw in the Telegram message oracle the bot used and transferred ETH out of users’ wallets	$3M from 11 users	Refunded from treasury; transfer delay and transfer 2FA added
Nov 16, 2024	DEXX (Solana terminal)	User private keys leaked from the platform	About $21M initially, 900+ users	Investigated with SlowMist; compensation dependent on recovery

Sources: The Block on Maestro, CoinDesk on Unibot, The Block on Banana Gun, Cointelegraph on DEXX.

Three patterns stand out:

1. Smart contract bugs hit approvals, not keys. Maestro and Unibot users lost tokens they had approved to the bot’s router. Their keys were fine.
2. Backend bugs hit keys or signing. Banana Gun and DEXX show that when the server side breaks, balances in bot wallets are directly exposed.
3. Refunds happened, but they are a choice. Maestro and Banana Gun paid users back. Nothing obliges any team to do so next time.

There’s also plain platform risk. BullX disabled trading on June 1, 2026 to work on a new version, leaving users with withdraw-only access. Not a hack, but a reminder that a bot can stop working overnight. Our BullX review covers that episode.

Fake bots and phishing: the bigger everyday risk

Most people who lose money to “a trading bot” lose it to a fake one. Common patterns:

• Clone bots. A Telegram username one character off the real one, often promoted in memecoin group chats or paid ads. You generate a wallet, deposit, and the operator simply takes it. Or it asks you to import your existing wallet “to sync”.
• Fake verification bots. Security firm Scam Sniffer documented a campaign using a fake “Safeguard” verification bot that tricked users into running malicious PowerShell code, which then stole keys. At least two victims lost over $3 million, according to Cointelegraph’s report.
• Fake support. Someone DMs you after you post about a stuck trade. Real teams don’t DM first, and none will ask for your key or seed phrase.
• Fake “new version” links. Especially around events like the BullX pause, when users are looking for where the product went.

The fix is boring and works: get bot handles only from the project’s own website or documentation. For reference, the official docs list t.me/maestro for Maestro, @solana_trojanbot for Trojan, and @BananaGunSniper_bot, @BananaGunSell_bot and @BananaGunRegister_bot for Banana Gun. Check them again yourself before trusting this list.

Token approvals: the EVM-specific risk

On Ethereum, Base, BSC and other EVM chains, a bot has to send an approve transaction before it can sell a token for you. That approval lets the bot’s router contract move that token from your wallet. Maestro’s “Auto Approve” setting does this automatically after every buy.

Approvals are normal, but they are exactly what the Maestro and Unibot exploits abused: a bug in the router turned every approval into an open door. To limit that:

• Trade from a wallet that only ever holds trading funds, so approvals can’t reach anything else.
• Every so often, open the wallet on a block explorer’s token approval checker and revoke approvals to routers you no longer use.
• Be extra careful with a bot right after it launches a new router contract. Unibot’s exploited router had been live for about a day.

Solana works differently: bots sign each swap directly rather than relying on long-lived approvals, so the main risk there is the key itself.

How to use Telegram bots more safely

1. Use a separate wallet. Generate a fresh wallet inside the bot. Never import your main wallet; Maestro’s docs make the same recommendation.
2. Keep balances small. Fund the bot with what you plan to trade this week. Sweep profits out to your own wallet regularly rather than letting them pile up.
3. Save the key at creation. Write it on paper, then delete the message from your chat with the bot. If the bot allows exporting later, do it once and store it offline.
4. Turn on Telegram two-step verification. In Telegram: Settings, Privacy and Security, Two-Step Verification, then set a password and a recovery email. This stops SIM-swap and SMS-code takeovers.
5. Set the bot’s own PIN or password. Banana Gun has a Security PIN that locks the bot after a session ends. BullX let users set a 6-digit password. Use whatever your bot offers.
6. Check logged-in devices. In Telegram’s Settings, Devices, end any session you don’t recognise. Be wary of QR-code logins on machines you don’t own, which BullX and Banana Gun both warn about.
7. Verify handles from official sites every time you start a new bot, and ignore links from group chats and DMs.
8. Revoke stale approvals on EVM chains, as above.

Where to keep the rest of your crypto

Your long-term holdings belong somewhere the key never touches a server, ideally a hardware wallet. See our comparison of the best hardware wallets for options at different prices. A common setup is hardware wallet for savings, a normal software wallet for DeFi, and a small bot wallet funded from it for memecoin trading.

So, which bots are reasonable to use?

All the major bots use the same custody model, so “safe” comes down to track record, transparency after incidents, and your own setup. Maestro and Banana Gun have each had an exploit and refunded users in full. Whatever the track record, none of them is a vault.

For fees, chains and features side by side, read our guide to the best Telegram trading bots, or the individual Maestro, Trojan and Banana Gun reviews. If you prefer a browser interface, the same precautions apply to terminals covered in Axiom vs GMGN vs Fomo.