# Trading bot or wallet drained? What to do

> Your trading bot or wallet was drained: protect what's left, cut off the way in, report it, and avoid recovery scams. Steps from official sources.

Canonical: https://tradingagentstack.com/trading-bot-drained-what-to-do/

1. [Home](https://tradingagentstack.com/)

2. Guides

# Trading bot or wallet drained? What to do now

If money left your wallet and you didn't send it, act in this order: protect what's left, cut off the way in, write everything down, report it, and ignore anyone who offers to get it back for a fee. Onchain transactions can't be reversed, so speed matters for what's still there.
⚠ **Bloom:** Under review (Oct 26, 2026): wallets used with Bloom were drained (about 9,400 SOL, signed with the owners' own keys). Bloom says 49 wallets belonging to 9 users were affected and it will fully reimburse them; it is still investigating the cause, including a possible third-party compromise. If you imported a key into Bloom, move funds to a fresh wallet with a new seed. [Check page](https://tradingagentstack.com/check/bloom/)
⚠ **BullX Neo:** Trading reported suspended since 2026-06-01; check the vendor before using it [Check page](https://tradingagentstack.com/check/bullx-neo/)

## 1. In the first minutes: protect what's left

1. **Check it was really an unauthorized transfer.** Look the transaction up in a block explorer: date, receiving address, amount, and which app or contract was involved ([source](https://support.metamask.io/stay-safe/protect-yourself/ive-been-hacked-scammed-unauthorized-transactions-on-my-account)).

2. **Make a new wallet with a new seed, on a clean device or browser profile.** Write the new recovery phrase down and never share it ([source](https://support.metamask.io/stay-safe/protect-yourself/ive-been-hacked-scammed-unauthorized-transactions-on-my-account)). Don't reuse the old seed or private key anywhere.

3. **Move whatever is left to the new wallet.** If you suspect a sweeper bot (anything you send in disappears at once), don't send fresh coins in to pay gas ([source](https://support.metamask.io/stay-safe/protect-yourself/ive-been-hacked-scammed-unauthorized-transactions-on-my-account); how to move assets: [source](https://support.metamask.io/manage-crypto/move-crypto/transfer/account-migration-guide/)).

4. **Stop using the old wallet** and every account tied to its recovery phrase ([source](https://support.metamask.io/stay-safe/protect-yourself/ive-been-hacked-scammed-unauthorized-transactions-on-my-account)).

## 2. Cut off the way in

What you do next depends on how they got in.

- **Your funds were in a Telegram or web trading bot.** Most of these bots create the wallet and keep its private key, so a breach at the bot, your Telegram account or a saved copy of the key can empty it. Withdraw what's left to a wallet only you control, turn on any second factor or withdraw-address lock the bot offers, and don't import that bot wallet's key into your main wallet. The table below shows what each bot we track documents.

- **You signed something on a website, then tokens left (EVM chains).** That is usually a token approval. Revoke it right away with Revoke.cash or your block explorer's Token Approvals page, even after the drain, because the same approval can be used again ([source](https://revoke.cash/learn/approvals/how-to-revoke-token-approvals)).

- **An exchange API key leaked** (from a bot platform, a repo or a server). Delete the key on the exchange's API page, check open orders and withdrawals, and create new keys with withdrawals off and an IP allowlist. Keys that can't withdraw can't move funds out, which is one of the inputs in our [Safety score](https://tradingagentstack.com/methodology/).

- **An AI agent made the transfers.** Revoke its keys or session permissions first, then review what it was allowed to do. Limits the agent can't override (per-order and daily caps, an allowlist, human approval over a threshold) are what [TAS Guard](https://tradingagentstack.com/guard/) adds between an agent and its wallet or broker.

## What each trading bot documents

From each bot's own docs, the same sources as our check pages. A bot that holds your key can always lose it; check the bot's official channels for its own instructions.

| Bot or terminal | Who holds the key | Moving funds out |
| --- | --- | --- |
| [Trojan](https://tradingagentstack.com/check/trojan/) | Not documented | Withdrawals from the Wallets page: you enter any receiving address and click Withdraw. [source](https://docs.trojan.com/faqs.md) |
| [Maestro](https://tradingagentstack.com/check/maestro/) | The service holds the key | The bot can send native coins and tokens to another of your bot wallets or to any external wallet address. [source](https://docs.maestrobots.com/sniper/wallet-setup.md) |
| [Banana Gun](https://tradingagentstack.com/check/banana-gun/) | The service holds the key | You can send tokens to any outside address via 'Custom Wallet'. After the 2024 exploit the team said transfers now have a 2-hour delay and 2FA (per The Block, 2024-09-25). [source](https://banana-gun.gitbook.io/banana-gun/trading/settings/wallet-settings.md ; https://www.theblock.co/post/318074/banana-gun-exploit-refund) |
| [BONKbot](https://tradingagentstack.com/check/bonkbot/) | The service holds the key | SOL withdrawals out of the bot are supported; with 2FA or a passkey enabled, withdrawals and private key export need the second factor. [source](https://docs.bonkbot.io/bonkbot/features/wallet-security-2fa.md) |
| [Bloom](https://tradingagentstack.com/check/bloom/) | The service holds the key | Withdrawals go to an address you set. You can lock that address; unlocking starts a 24-hour cooldown before it can be changed. [source](https://docs.bloombot.app/solana/solana-bot/withdraw.md) |
| [Sigma](https://tradingagentstack.com/check/sigma/) | The service holds the key | Not confirmed from vendor documentation (docs.sigma.win could not be fetched). |
| [GMGN](https://tradingagentstack.com/check/gmgn/) | The service holds the key | Withdrawals only via the website, and they need Google Authenticator plus a whitelisted address. Changing the whitelist triggers a 3-hour withdrawal lock. [source](https://www.datawallet.com/crypto/gmgn-explained) |
| [Photon](https://tradingagentstack.com/check/photon/) | The service holds the key | Withdrawal behaviour not confirmed from a vendor or reliable source. |
| [BullX Neo](https://tradingagentstack.com/check/bullx-neo/) | Not documented | Per the June 2026 announcement as reported by Phemex, withdrawals and wallet management stay operational while trading is suspended. [source](https://phemex.com/news/article/bullx-suspends-trading-functionality-to-focus-on-future-development-87410) |
| [Axiom](https://tradingagentstack.com/check/axiom/) | Not documented | Not confirmed from vendor documentation (docs.axiom.trade could not be fetched). |
| [Padre](https://tradingagentstack.com/check/padre/) | Not documented | Not confirmed from vendor documentation. |
| [Unibot](https://tradingagentstack.com/check/unibot/) | The service holds the key | Not confirmed from vendor documentation. |
| [Fomo](https://tradingagentstack.com/check/fomo/) | You hold the key | You can export the wallet's private keys (terms). Fomo also supports bank withdrawals through the app, which it says arrive within 3 business days. [source](https://fomo.family/terms ; https://fomo.family/answers/how-long-to-withdraw-from-fomo) |
| [BasedBot](https://tradingagentstack.com/check/basedbot/) | Not documented | Withdraw button: pick a network, then enter any address and an amount. [source](https://docs.basedbot.app/quick-setup-guide/based-bot-set-up/managing-wallets.md) |
| [Genius Terminal](https://tradingagentstack.com/check/genius-terminal/) | Shared (MPC) | Private keys for both wallets can be exported. The docs we read cover deposits but have no separate withdrawal page. [source](https://docs.tradegenius.com/account-set-up/wallets-and-keys.md) |
| [Based](https://tradingagentstack.com/check/based-one/) | You hold the key | Deposits and withdrawals are managed in the terminal, and you can set withdrawal addresses. [source](https://basedapp.gitbook.io/docs/based/web-terminal.md) |
| [HyperDash](https://tradingagentstack.com/check/hyperdash/) | You hold the key | The terms cover transfers and withdrawals of assets from the platform. They warn that funds sent to an exchange deposit address, or to an address that does not support Hyperliquid, may be lost, and that this is your responsibility. [source](https://hyperdash.com/terms) |
| [Insilico Terminal](https://tradingagentstack.com/check/insilico-terminal/) | You hold the key | Insilico never holds your funds. Withdrawals happen on the exchange or Hyperliquid account itself, and Insilico tells you never to enable withdrawals on the API keys you give it. [source](https://docs.insilicoterminal.com/documentation/welcome/security.md) |
| [SolTradingBot](https://tradingagentstack.com/check/soltradingbot/) | The service holds the key | The bot shows each generated wallet's private key, so you can import it into another wallet and move the funds. [source](https://soltradingbot.gitbook.io/docs/feature-and-instruction/wallet-and-multi-wallet/multi-wallet-creation.md) |
| [Moonshot](https://tradingagentstack.com/check/moonshot/) | You hold the key | You can withdraw by direct transfer over Solana (USDC or SOL), or cash out through off-ramp providers (MoonPay, Coinbase, Robinhood), depending on your region. [source](https://support.moonshot.com/get-started/withdraw) |
| [MevX](https://tradingagentstack.com/check/mevx/) | The service holds the key | MevX shows the trading wallet's private key once at login, so you can import it into another wallet and move funds. We found no separate withdrawal page in the docs. [source](https://docs.mevx.io/docs/mevx-login.md) |
| [Ave.ai](https://tradingagentstack.com/check/ave-ai/) | The service holds the key | The bot wallet's mnemonic is shown once at creation, so a saved copy lets you restore the wallet elsewhere and move funds. We found no withdrawal page in the docs. [source](https://doc.ave.ai/tutorial/tg-bot-tutorial/create-bot-wallet.md) |
| [3Commas](https://tradingagentstack.com/check/3commas/) | The exchange holds your funds | Only if the key is set up as 3Commas' docs say: 3Commas guides tell you to 'provide TRADING access only and DISABLE the withdrawal option', and Kraken's 3Commas page says withdrawal permission is not required. A key with withdrawal enabled could move funds if leaked. Even a trade-only key can place bad orders on your balance, which is how the 2022 thefts worked (per Bitsgap and Coin Bureau). [source](https://help.3commas.io/en/articles/16281186-create-and-connect-api-keys) |

## 3. Write everything down

- Every transaction hash and the attacker's receiving address.

- A timeline: what you connected, signed or installed, and when.

- Screenshots of chats, ads or anyone who contacts you about the theft, including people offering recovery help ([source](https://www.fbi.gov/contact-us/field-offices/elpaso/news/fbi-tech-tuesday-building-a-defense-against-cryptocurrency-recovery-scams)).

## 4. Report it

- **Police and, in the US, the FBI's IC3** at ic3.gov. Include transaction details and records of any contact from people offering recovery services ([source](https://www.ic3.gov/PSA/2023/PSA230811)).

- **Chainabuse** (chainabuse.com), a free public scam-report database run by TRM Labs. Reports about the same address are combined and partner platforms see them ([source](https://www.trmlabs.com/resources/blog/announcing-the-launch-of-chainabuse-the-multi-chain-scam-reporting-tool-that-empowers-crypto-users-against-fraud)).

- **Exchanges the funds went to.** Send them the transaction hashes. Exchanges freeze accounts only through their own processes or in response to legal process ([source](https://www.ic3.gov/PSA/2023/PSA230811)).

- **The bot or wallet you used**, through its official support channel only. Find the official links on its [TAS Check](https://tradingagentstack.com/check/) page; fake support accounts appear fast after a drain.

## 5. Ignore anyone who offers to get it back

Theft victims are a target. The FBI warns about fake recovery services that reach out on social media, in comments and in search ads, ask for upfront fees, claim law-enforcement ties, and go quiet after the first payment ([source](https://www.ic3.gov/PSA/2023/PSA230811)). Private recovery companies can't issue seizure orders, and real law enforcement doesn't charge victims to investigate ([source](https://www.ic3.gov/PSA/2023/PSA230811); [source](https://www.fbi.gov/contact-us/field-offices/elpaso/news/fbi-tech-tuesday-building-a-defense-against-cryptocurrency-recovery-scams)). Never share your seed phrase with anyone.

## 6. Before you connect anything again

- Check the bot, exchange or wallet on [TAS Check](https://tradingagentstack.com/check/) or with [@TASCheckBot](https://t.me/TASCheckBot) in Telegram: is the link official, who holds the key, what's the worst case.

- Keep only trading money in any wallet a bot can touch, and use a separate wallet for long-term holdings.

- Watch the [incident tracker](https://tradingagentstack.com/incidents/) for breaches at tools you use.

- Planned: [drain alerts](https://tradingagentstack.com/drain-alerts/) on Telegram for the wallets your bots and agents use, from public addresses only. Not live yet; join the waitlist if you'd use it.

- In the X posts we studied, most first-person losses came from bots holding people's keys, not from AI going rogue ([the study](https://tradingagentstack.com/research/x-demand-study/)).

## Questions

### Can a crypto transaction be reversed?

No. Onchain transactions can't be reversed, and a self-custodial wallet provider can't recover funds for you (MetaMask's guide says so directly). What you can still do is protect what's left, report the theft and flag the attacker's address.

### Can a recovery company get my crypto back?

Be very careful. The FBI warns that fake recovery services target theft victims, ask for upfront fees and may claim to work with law enforcement. Private recovery companies can't issue seizure orders, and real law enforcement doesn't charge victims to investigate.

### Should I import my old private key into a new wallet app?

No. If the key or seed was stolen, any wallet using it is exposed. Create a new wallet with a new seed and move what's left to it, then stop using the old one.

### Does revoking token approvals help after a drain?

If the theft came from an approval you signed (common with phishing sites on EVM chains), yes: revoke it, because an approval can be used again later. If your private key was taken, revoking doesn't stop the thief: move funds to a new wallet.

## Sources

- [MetaMask: I've been hacked or scammed](https://support.metamask.io/stay-safe/protect-yourself/ive-been-hacked-scammed-unauthorized-transactions-on-my-account)

- [MetaMask: migrate your assets to a new wallet](https://support.metamask.io/manage-crypto/move-crypto/transfer/account-migration-guide/)

- [Revoke.cash: how to revoke token approvals](https://revoke.cash/learn/approvals/how-to-revoke-token-approvals)

- [FBI IC3 PSA: companies falsely claiming they can recover crypto (Aug 11, 2023)](https://www.ic3.gov/PSA/2023/PSA230811)

- [FBI El Paso: defending against crypto recovery scams (Nov 14, 2023)](https://www.fbi.gov/contact-us/field-offices/elpaso/news/fbi-tech-tuesday-building-a-defense-against-cryptocurrency-recovery-scams)

- [TRM Labs: Chainabuse, the multi-chain scam reporting tool](https://www.trmlabs.com/resources/blog/announcing-the-launch-of-chainabuse-the-multi-chain-scam-reporting-tool-that-empowers-crypto-users-against-fraud)

General information, not financial or legal advice. Spot something wrong? [Tell us](https://tradingagentstack.com/submit/).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)