# Is BONKbot safe? Check before you connect

> BONKbot: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-24.

Canonical: https://tradingagentstack.com/check/bonkbot/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. BONKbot

# Is BONKbot safe to connect?

Telegram trading bot · Solana. Checked 2026-10-24; every line links its source.

**Worst case:** BONKbot's backend generates and stores your trading wallet's key and signs when your Telegram tells it to. A hijacked Telegram account without 2FA, a leaked exported key, or a failure of BONKbot's key system could let someone drain the wallet.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Turn on BONKbot's 2FA or passkey so that withdrawals and private-key export need a second factor even if your Telegram is hijacked

2. Only start @bonkbot_bot (or the alternates listed in docs.bonkbot.io); fake bots ask you to 'deposit SOL', and real admins never DM first

3. Don't paste your exported BONKbot key into other bots or apps (the 2024 drain victims had done exactly that), and keep only trading funds in the bot

BONKbot also has a full listing with an Agent Risk Score [Agent risk 50% (partial, 2 of 7 inputs)](https://tradingagentstack.com/methodology/#agent-risk-score): [BONKbot on TradingAgentStack](https://tradingagentstack.com/tool/bonkbot/).

## What it can do with your money

| Who holds the keys | The service holds the keys BONKbot calls itself non-custodial since its 2024 key-management system (KMS), but its own post says the Signer 'generates the user's private key and stores it encrypted' on BONKbot's backend (hardware security module (HSM)-backed), with signing authorized only through your Telegram. Private key export and SOL withdrawals can be gated behind 2FA or a passkey. [source](https://bonkbot.io/blog/a-hardware-wallet-in-the-cloud-introducing-bonkbot-s-next-gen-key-management-system) |
| --- | --- |
| Can funds be sent out to any address? | Yes. SOL withdrawals out of the bot are supported; with 2FA or a passkey enabled, withdrawals and private key export need the second factor. [source](https://docs.bonkbot.io/bonkbot/features/wallet-security-2fa.md) |

## Official links

Each link below was confirmed from at least two independent places (the vendor's own pages plus another source). Anything else using this name is not on the list.

- Website: `bonkbot.io`

- Telegram: `@bonkbot_bot`

- X: `@bonkbot_io`

Where we confirmed these
- https://bonkbot.io/blog/a-hardware-wallet-in-the-cloud-introducing-bonkbot-s-next-gen-key-management-system (links bonkbot.io, docs.bonkbot.io, x.com/bonkbot_io, t.me/bonkbot_bot)

- https://docs.bonkbot.io/bonkbot/quick-setup-guide/initializing-bonkbot.md (bot link t.me/bonkbot_bot)

- https://docs.bonkbot.io/bonkbot/safety-and-security/avoiding-scams.md (official bot link t.me/bonkbot_bot)

- https://www.cryptopolitan.com/bonkbot-is-going-non-custodial-with-increased-security-measures/ (third-party: @bonkbot_io, bonkbot.io blog)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2024-03-29 | Wallet-drainer wave hit 302 Solana wallets; 113 victims had used BONKbot. BONKbot denied it was the source and said all 113 had exported their keys to another app (Solareum suspected) (reported by users) | ~2,808 SOL (~$523K) total across all victims | BONKbot denied responsibility; no refunds reported | [source](https://decrypt.co/224127/solana-wallets-drained-523k-bonkbot-denies-link) |

## Check a link

Got a link, @handle or repo that claims to be BONKbot? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for BONKbot

We email you if we add an incident, a freeze report, a known fake or a deadline for BONKbot. Free; unsubscribe anytime.

## More checks: Telegram trading bots
[Trojan](https://tradingagentstack.com/check/trojan/)[Maestro](https://tradingagentstack.com/check/maestro/)[Banana Gun](https://tradingagentstack.com/check/banana-gun/)[Bloom](https://tradingagentstack.com/check/bloom/)[Sigma](https://tradingagentstack.com/check/sigma/)[Unibot](https://tradingagentstack.com/check/unibot/)[BasedBot](https://tradingagentstack.com/check/basedbot/)[SolTradingBot](https://tradingagentstack.com/check/soltradingbot/)[MevX](https://tradingagentstack.com/check/mevx/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)