Are Telegram Trading Bots Safe? The Custody Truth Nobody Leads With
Last verified: August 11, 2026. No referral links on this page. This is the page we wish had existed when we started using these bots.
Search this question and you will find bot companies grading their own homework and affiliate sites that answer "yes" above a signup button. Here is the actual mechanics, the actual incident history, and the one rule that follows from both.
What actually happens to your money
When you start any Telegram trading bot, it generates a fresh wallet for you. This is the design's genius and its risk in one move. The genius: you never connect your personal wallet, never sign approvals with it, so a bot cannot touch what you did not deposit. Your existing funds are structurally out of reach. The risk: the generated wallet's keys live on the bot's infrastructure. Whatever the interface says about encryption or "your keys", if the bot's servers can sign your trades in milliseconds, the bot's infrastructure can spend your deposit. That is custody in everything but name, and it applies to every bot in this category: Maestro, Banana Gun, BasedBot, BonkBot, Trojan, all of them. Some document key export (BonkBot, Trojan), which helps you recover funds if the interface dies, but does not change who holds the live keys.
The incident record through August 2026
| Date | Bot | What happened | Outcome for users |
|---|---|---|---|
| Oct 2023 | Maestro | Router contract exploited, ~280 ETH taken from 106 users | Fully refunded within ~1 day (610 ETH paid out) |
| Sept 2024 | Banana Gun | Telegram message oracle flaw, ~$3M drained from 11 users | Fully refunded from treasury, 2FA added |
| Late 2025 | GMGN (terminal) | Phishing clone sites, not the platform itself, stole $700K+ from users | Individual losses, not refundable by the platform |
| June 2026 | BullX (terminal) | No hack: trading suspended indefinitely, withdrawals left open | Funds retrievable, platform unusable |
Read the pattern: the serious bot teams refunded everything, fast, because their business dies otherwise. The unrefundable losses came from fake sites, and the strangest failure mode was not theft but a platform simply stopping. All three risks are real and none of them is "the bot stole my money".
The one rule, and its corollaries
- Save the key at creation. Every bot shows the wallet's private key once when it is generated. Store it like a password. With it, a dead interface does not mean dead funds.
- Type URLs, never follow them. The largest user losses of 2025 were clone sites. Bookmark the real bot and the real site once, from the official docs.
- Withdraw profits on a schedule. A float stays a float only if you skim it. Weekly is fine. The habit matters more than the interval.
- Distrust any bot promising returns. Real bots sell execution and charge about 1% per trade. "AI trading bot guaranteed profit" is a different product category: theft.
Legit is not the same as safe
The bots we review are legitimate businesses: real volume, published fees, multi-year records. Most of their teams are also anonymous, unaudited, and hold your deposit. Both facts are true at once, which is exactly why this site marks incidents and custody on every comparison row and every review, next to the referral links it earns from. You deserve both facts in the same table.
FAQ
Can I lose more than I deposit?
No. Spot bots trade what you fund and nothing more. There is no leverage unless you seek out perps products, and no approval that reaches your other wallets.
Is it safer to use a web terminal instead?
Terminals like Axiom that connect to a wallet you control are structurally less custodial. Terminals with in-app wallets (GMGN, Photon) sit in between. The float rule serves you identically in all three designs.
Which bot has the best safety record?
BonkBot and Trojan have no incidents on record; Maestro and Banana Gun each have one breach and one full refund. We weigh those roughly equally, and explain why in the Solana comparison and the multichain one.