Trading bot or wallet drained? What to do now

If money left your wallet and you didn't send it, act in this order: protect what's left, cut off the way in, write everything down, report it, and ignore anyone who offers to get it back for a fee. Onchain transactions can't be reversed, so speed matters for what's still there.

⚠ Bloom: Under review (Oct 26, 2026): wallets used with Bloom were drained (about 9,400 SOL, signed with the owners' own keys). Bloom says 49 wallets belonging to 9 users were affected and it will fully reimburse them; it is still investigating the cause, including a possible third-party compromise. If you imported a key into Bloom, move funds to a fresh wallet with a new seed. Check page

⚠ BullX Neo: Trading reported suspended since 2026-06-01; check the vendor before using it Check page

1. In the first minutes: protect what's left

Check it was really an unauthorized transfer. Look the transaction up in a block explorer: date, receiving address, amount, and which app or contract was involved (source).
Make a new wallet with a new seed, on a clean device or browser profile. Write the new recovery phrase down and never share it (source). Don't reuse the old seed or private key anywhere.
Move whatever is left to the new wallet. If you suspect a sweeper bot (anything you send in disappears at once), don't send fresh coins in to pay gas (source; how to move assets: source).
Stop using the old wallet and every account tied to its recovery phrase (source).

2. Cut off the way in

What you do next depends on how they got in.

Your funds were in a Telegram or web trading bot. Most of these bots create the wallet and keep its private key, so a breach at the bot, your Telegram account or a saved copy of the key can empty it. Withdraw what's left to a wallet only you control, turn on any second factor or withdraw-address lock the bot offers, and don't import that bot wallet's key into your main wallet. The table below shows what each bot we track documents.
You signed something on a website, then tokens left (EVM chains). That is usually a token approval. Revoke it right away with Revoke.cash or your block explorer's Token Approvals page, even after the drain, because the same approval can be used again (source).
An exchange API key leaked (from a bot platform, a repo or a server). Delete the key on the exchange's API page, check open orders and withdrawals, and create new keys with withdrawals off and an IP allowlist. Keys that can't withdraw can't move funds out, which is one of the inputs in our Safety score.
An AI agent made the transfers. Revoke its keys or session permissions first, then review what it was allowed to do. Limits the agent can't override (per-order and daily caps, an allowlist, human approval over a threshold) are what TAS Guard adds between an agent and its wallet or broker.

What each trading bot documents

From each bot's own docs, the same sources as our check pages. A bot that holds your key can always lose it; check the bot's official channels for its own instructions.

Bot or terminal	Who holds the key	Moving funds out
Trojan	Not documented	Withdrawals from the Wallets page: you enter any receiving address and click Withdraw. source
Maestro	The service holds the key	The bot can send native coins and tokens to another of your bot wallets or to any external wallet address. source
Banana Gun	The service holds the key	You can send tokens to any outside address via 'Custom Wallet'. After the 2024 exploit the team said transfers now have a 2-hour delay and 2FA (per The Block, 2024-09-25). source
BONKbot	The service holds the key	SOL withdrawals out of the bot are supported; with 2FA or a passkey enabled, withdrawals and private key export need the second factor. source
Bloom	The service holds the key	Withdrawals go to an address you set. You can lock that address; unlocking starts a 24-hour cooldown before it can be changed. source
Sigma	The service holds the key	Not confirmed from vendor documentation (docs.sigma.win could not be fetched).
GMGN	The service holds the key	Withdrawals only via the website, and they need Google Authenticator plus a whitelisted address. Changing the whitelist triggers a 3-hour withdrawal lock. source
Photon	The service holds the key	Withdrawal behaviour not confirmed from a vendor or reliable source.
BullX Neo	Not documented	Per the June 2026 announcement as reported by Phemex, withdrawals and wallet management stay operational while trading is suspended. source
Axiom	Not documented	Not confirmed from vendor documentation (docs.axiom.trade could not be fetched).
Padre	Not documented	Not confirmed from vendor documentation.
Unibot	The service holds the key	Not confirmed from vendor documentation.
Fomo	You hold the key	You can export the wallet's private keys (terms). Fomo also supports bank withdrawals through the app, which it says arrive within 3 business days. source
BasedBot	Not documented	Withdraw button: pick a network, then enter any address and an amount. source
Genius Terminal	Shared (MPC)	Private keys for both wallets can be exported. The docs we read cover deposits but have no separate withdrawal page. source
Based	You hold the key	Deposits and withdrawals are managed in the terminal, and you can set withdrawal addresses. source
HyperDash	You hold the key	The terms cover transfers and withdrawals of assets from the platform. They warn that funds sent to an exchange deposit address, or to an address that does not support Hyperliquid, may be lost, and that this is your responsibility. source
Insilico Terminal	You hold the key	Insilico never holds your funds. Withdrawals happen on the exchange or Hyperliquid account itself, and Insilico tells you never to enable withdrawals on the API keys you give it. source
SolTradingBot	The service holds the key	The bot shows each generated wallet's private key, so you can import it into another wallet and move the funds. source
Moonshot	You hold the key	You can withdraw by direct transfer over Solana (USDC or SOL), or cash out through off-ramp providers (MoonPay, Coinbase, Robinhood), depending on your region. source
MevX	The service holds the key	MevX shows the trading wallet's private key once at login, so you can import it into another wallet and move funds. We found no separate withdrawal page in the docs. source
Ave.ai	The service holds the key	The bot wallet's mnemonic is shown once at creation, so a saved copy lets you restore the wallet elsewhere and move funds. We found no withdrawal page in the docs. source
3Commas	The exchange holds your funds	Only if the key is set up as 3Commas' docs say: 3Commas guides tell you to 'provide TRADING access only and DISABLE the withdrawal option', and Kraken's 3Commas page says withdrawal permission is not required. A key with withdrawal enabled could move funds if leaked. Even a trade-only key can place bad orders on your balance, which is how the 2022 thefts worked (per Bitsgap and Coin Bureau). source

3. Write everything down

Every transaction hash and the attacker's receiving address.
A timeline: what you connected, signed or installed, and when.
Screenshots of chats, ads or anyone who contacts you about the theft, including people offering recovery help (source).

4. Report it

Police and, in the US, the FBI's IC3 at ic3.gov. Include transaction details and records of any contact from people offering recovery services (source).
Chainabuse (chainabuse.com), a free public scam-report database run by TRM Labs. Reports about the same address are combined and partner platforms see them (source).
Exchanges the funds went to. Send them the transaction hashes. Exchanges freeze accounts only through their own processes or in response to legal process (source).
The bot or wallet you used, through its official support channel only. Find the official links on its TAS Check page; fake support accounts appear fast after a drain.

5. Ignore anyone who offers to get it back

Theft victims are a target. The FBI warns about fake recovery services that reach out on social media, in comments and in search ads, ask for upfront fees, claim law-enforcement ties, and go quiet after the first payment (source). Private recovery companies can't issue seizure orders, and real law enforcement doesn't charge victims to investigate (source; source). Never share your seed phrase with anyone.

6. Before you connect anything again

Check the bot, exchange or wallet on TAS Check or with @TASCheckBot in Telegram: is the link official, who holds the key, what's the worst case.
Keep only trading money in any wallet a bot can touch, and use a separate wallet for long-term holdings.
Watch the incident tracker for breaches at tools you use.
Planned: drain alerts on Telegram for the wallets your bots and agents use, from public addresses only. Not live yet; join the waitlist if you'd use it.
In the X posts we studied, most first-person losses came from bots holding people's keys, not from AI going rogue (the study).

Questions

Can a crypto transaction be reversed?

No. Onchain transactions can't be reversed, and a self-custodial wallet provider can't recover funds for you (MetaMask's guide says so directly). What you can still do is protect what's left, report the theft and flag the attacker's address.

Can a recovery company get my crypto back?

Be very careful. The FBI warns that fake recovery services target theft victims, ask for upfront fees and may claim to work with law enforcement. Private recovery companies can't issue seizure orders, and real law enforcement doesn't charge victims to investigate.

Should I import my old private key into a new wallet app?

No. If the key or seed was stolen, any wallet using it is exposed. Create a new wallet with a new seed and move what's left to it, then stop using the old one.

Does revoking token approvals help after a drain?

If the theft came from an approval you signed (common with phishing sites on EVM chains), yes: revoke it, because an approval can be used again later. If your private key was taken, revoking doesn't stop the thief: move funds to a new wallet.

Sources

General information, not financial or legal advice. Spot something wrong? Tell us.