Is Shuriken safe to connect?
Telegram trading bot · Solana, Base, BSC, Monad, Older bot (per its Telegram channels): also Ethereum, Sui, Tron and Bitcoin. Checked 2026-10-28; every line links its source.
Worst case: Shuriken's bot creates your trading wallet and its servers execute trades from it. If your Telegram account (which also logs you into the web Terminal), an exported private key, a trading Agent Key, a tampered extension zip or Shuriken's systems are compromised, the wallet can be traded away or emptied. The docs we read describe no PIN, 2FA or withdrawal lock to slow this down.
Safe setup in 3 steps
- Start the bot only from links on Shuriken's own docs or Telegram channels (@ShurikenTradeBot as listed on t.me/ShurikenAnnouncements), log in to the Terminal only at app.shuriken.trade, and install the browser extension only from the download link in docs.shuriken.trade; never run 'Shuriken' installers from GitHub or DMs
- Create a fresh bot wallet rather than importing your main wallet, export its private key right away and store it offline (the docs say Shuriken does not store it and staff 'will never ask for your private key'), and keep only active trading funds in it
- Turn on Telegram 2-step verification, leave Degen Mode off, and give Agent Keys read-only access or tight dollar, slippage and wallet limits, and watch their activity in the Agent Keys dashboard
What it can do with your money
| Who holds the keys | Not documented The bot creates a Solana or EVM wallet when you tap 'Create Wallet' and lets you export its private key ('You can export the private key of any wallet created in Telegram Bot'); you can also import a wallet by pasting its private key. The docs say 'Shuriken does not store your private keys' and that you must export and store keys before deleting a wallet, but they don't explain how the bot signs your trades without them. The Agent Kit page says trading limits are 'enforced server-side' by Shuriken, so trades run through Shuriken's servers. Wallets sync between the bot and the web Terminal. source source |
|---|---|
| Can funds be sent out to any address? | Yes. The docs tell you to 'transfer any remaining funds to another wallet' before deleting one, and the bot's /wallets → Transfer menu also runs cross-chain swaps (deBridge, ChangeNOW). The docs we could read describe no PIN, 2FA, withdrawal-address lock or confirmation step; 'Degen Mode' removes the confirmation step from trades. source source |
| What a leaked API key can do | Shuriken's AI Agent Kit uses 'Agent Keys' that connect AI tools (Claude, Cursor, Windsurf, OpenClaw and other MCP clients) to your account. 'Read-only' keys can't access your wallet; trading keys can trade 'within your set limits' (dollar caps, slippage caps, allowed wallets), which Shuriken says it enforces server-side. The overview mentions no transfer or withdrawal scope; the Permissions & Safety page could not be opened. source |
Official links
- Website:
shuriken.trade - Website:
docs.shuriken.trade - Website:
app.shuriken.trade - Telegram:
@ShurikenTradeBot - Telegram:
@ShurikenSupportBot - Telegram:
@ShurikenAnnouncements - Telegram:
@ShurikenDojo - X:
@ShurikenTrade
Where we confirmed these
Incidents
None found in official sources or reputable reporting for 2024 to 2026. That doesn't prove nothing happened.