Trading bot or wallet drained? What to do now

If money left your wallet and you didn't send it, act in this order: protect what's left, cut off the way in, write everything down, report it, and ignore anyone who offers to get it back for a fee. Onchain transactions can't be reversed, so speed matters for what's still there.

⚠ Bloom: Oct 26, 2026: Bloom says a remote code execution flaw in a third-party module let an attacker drain 49 wallets of 9 users (about 9,408 SOL). It says no private keys were compromised, has refunded all 9,408 SOL, and took its systems offline as a precaution; log in again only through bloombot.app when it announces services are back. Check page

⚠ BullX Neo: Trading reported suspended since 2026-06-01; check the vendor before using it Check page

⚠ Keystone: Oct 26, 2026: Keystone says an attacker took customer records and the key its website uses to check that a device is genuine. Recovery phrases and private keys were not involved, but counterfeit devices could pass that check. If you received a Keystone after October 20, 2026, follow Keystone's verification guidance before using it, and ignore any 'asset migration' or 'wallet verification' message. Check page

⚠ Ledger Live (now Ledger Wallet): Oct 13, 2026: Ledger says devices sold by the Southeast Asian reseller CryptoBilis had hidden implants that stole recovery phrases during setup. If you bought from CryptoBilis, don't set up an unused device; if you already did, move your funds to a new device with a new recovery phrase. Check page

1. In the first minutes: protect what's left

Check it was really an unauthorized transfer. Look the transaction up in a block explorer: date, receiving address, amount, and which app or contract was involved (source).
Make a new wallet with a new seed, on a clean device or browser profile. Write the new recovery phrase down and never share it (source). Don't reuse the old seed or private key anywhere.
Move whatever is left to the new wallet. If you suspect a sweeper bot (anything you send in disappears at once), don't send fresh coins in to pay gas (source; how to move assets: source).
Stop using the old wallet and every account tied to its recovery phrase (source).

2. Cut off the way in

What you do next depends on how they got in.

Your funds were in a Telegram or web trading bot. Most of these bots create the wallet and keep its private key, so a breach at the bot, your Telegram account or a saved copy of the key can empty it. Withdraw what's left to a wallet only you control, turn on any second factor or withdraw-address lock the bot offers, and don't import that bot wallet's key into your main wallet. The table below shows what each bot we track documents.
You signed something on a website, then tokens left (EVM chains). That is usually a token approval. Revoke it right away with Revoke.cash or your block explorer's Token Approvals page, even after the drain, because the same approval can be used again (source).
An exchange API key leaked (from a bot platform, a repo or a server). Delete the key on the exchange's API page, check open orders and withdrawals, and create new keys with withdrawals off and an IP allowlist. Keys that can't withdraw can't move funds out, which is one of the inputs in our Safety score.
An AI agent made the transfers. Revoke its keys or session permissions first, then review what it was allowed to do. Limits the agent can't override (per-order and daily caps, an allowlist, human approval over a threshold) are what TAS Guard adds between an agent and its wallet or broker.

What each trading bot documents

From each bot's own docs, the same sources as our check pages. A bot that holds your key can always lose it; check the bot's official channels for its own instructions.

Bot or terminal	Who holds the key	Moving funds out
Trojan	Not documented	Withdrawals from the Wallets page: you enter any receiving address and click Withdraw. source
Maestro	The service holds the key	The bot can send native coins and tokens to another of your bot wallets or to any external wallet address. source
Banana Gun	The service holds the key	You can send tokens to any outside address via 'Custom Wallet'. After the 2024 exploit the team said transfers now have a 2-hour delay and 2FA (per The Block, 2024-09-25). source
BONKbot	The service holds the key	SOL withdrawals out of the bot are supported; with 2FA or a passkey enabled, withdrawals and private key export need the second factor. source
Bloom	The service holds the key	Withdrawals go to an address you set. You can lock that address; unlocking starts a 24-hour cooldown before it can be changed. source
Sigma	The service holds the key	Not confirmed from vendor documentation (docs.sigma.win could not be fetched).
GMGN	The service holds the key	Withdrawals only via the website, and they need Google Authenticator plus a whitelisted address. Changing the whitelist triggers a 3-hour withdrawal lock. source
Photon	The service holds the key	Withdrawal behaviour not confirmed from a vendor or reliable source.
BullX Neo	Not documented	Per the June 2026 announcement as reported by Phemex, withdrawals and wallet management stay operational while trading is suspended. source
Axiom	Not documented	Not confirmed from vendor documentation (docs.axiom.trade could not be fetched).
Padre	Not documented	Not confirmed from vendor documentation.
Unibot	The service holds the key	Not confirmed from vendor documentation.
Fomo	You hold the key	You can export the wallet's private keys (terms). Fomo also supports bank withdrawals through the app, which it says arrive within 3 business days. source
BasedBot	Not documented	Withdraw button: pick a network, then enter any address and an amount. source
Genius Terminal	Shared (MPC)	Private keys for both wallets can be exported. The docs we read cover deposits but have no separate withdrawal page. source
Based	You hold the key	Deposits and withdrawals are managed in the terminal, and you can set withdrawal addresses. source
HyperDash	You hold the key	The terms cover transfers and withdrawals of assets from the platform. They warn that funds sent to an exchange deposit address, or to an address that does not support Hyperliquid, may be lost, and that this is your responsibility. source
Insilico Terminal	You hold the key	Insilico never holds your funds. Withdrawals happen on the exchange or Hyperliquid account itself, and Insilico tells you never to enable withdrawals on the API keys you give it. source
SolTradingBot	The service holds the key	The bot shows each generated wallet's private key, so you can import it into another wallet and move the funds. source
Moonshot	You hold the key	You can withdraw by direct transfer over Solana (USDC or SOL), or cash out through off-ramp providers (MoonPay, Coinbase, Robinhood), depending on your region. source
MevX	The service holds the key	MevX shows the trading wallet's private key once at login, so you can import it into another wallet and move funds. We found no separate withdrawal page in the docs. source
Ave.ai	The service holds the key	The bot wallet's mnemonic is shown once at creation, so a saved copy lets you restore the wallet elsewhere and move funds. We found no withdrawal page in the docs. source
3Commas	The exchange holds your funds	Only if the key is set up as 3Commas' docs say: 3Commas guides tell you to 'provide TRADING access only and DISABLE the withdrawal option', and Kraken's 3Commas page says withdrawal permission is not required. A key with withdrawal enabled could move funds if leaked. Even a trade-only key can place bad orders on your balance, which is how the 2022 thefts worked (per Bitsgap and Coin Bureau). source
Bitsgap	The exchange holds your funds	Bitsgap refuses API keys that have withdrawal permission: its error-status article says 'The API key can't be used because the withdrawal permission is enabled', and its blog says such keys 'are rejected automatically on connection'. A trade-only key can still be misused to place bad trades on your balance; Bitsgap's blog warns a compromised key 'can still be misused within its trading scope, for instance to manipulate a thin market.' source
OctoBot	The exchange holds your funds	Only if your key is limited to what OctoBot's guides ask for: for Binance, 'Enable Reading' and 'Enable Spot & Margin Trading'. OctoBot's guides we could read do not say to disable withdrawals or explain how keys are protected, so a key you create with withdrawal rights could be emptied if the bot's machine or config leaks. Even a trade-only key can place bad trades on your balance. source
DEXTools	You hold the key	Not applicable: your funds stay in the wallet you connect, and you send them from that wallet. DEXTools has no balance of yours to withdraw. source
Nova	The service holds the key	Withdrawals run from /wallets: you choose a wallet, an amount and any receiving address. If you set a Security Pin, the bot asks for it first. source
Jupiter	You hold the key	You sign every send yourself, to any address. Exception: the extension's Auto-Approve is ON by default for jup.ag, vote.jup.ag, lock.jup.ag and verified.jup.ag. It signs there without showing the approval screen unless the transaction is above a spending limit you set (the default can be 'No limit'). Hardware wallets always ask for confirmation. source
Shuriken	Not documented	The docs tell you to 'transfer any remaining funds to another wallet' before deleting one, and the bot's /wallets → Transfer menu also runs cross-chain swaps (deBridge, ChangeNOW). The docs we could read describe no PIN, 2FA, withdrawal-address lock or confirmation step; 'Degen Mode' removes the confirmation step from trades. source
Jumper	You hold the key	You sign every swap and bridge yourself, and the destination address can be any address you enter. A token approval you gave LI.FI's contract can be used without a new signature from you: in 2022 and 2024, bugs in newly added contract code let attackers pull tokens from wallets with old infinite approvals (153 wallets in 2024). Finite approvals were not affected. source

3. Write everything down

Every transaction hash and the attacker's receiving address.
A timeline: what you connected, signed or installed, and when.
Screenshots of chats, ads or anyone who contacts you about the theft, including people offering recovery help (source).

4. Report it

Police and, in the US, the FBI's IC3 at ic3.gov. Include transaction details and records of any contact from people offering recovery services (source).
Chainabuse (chainabuse.com), a free public scam-report database run by TRM Labs. Reports about the same address are combined and partner platforms see them (source).
Exchanges the funds went to. Send them the transaction hashes. Exchanges freeze accounts only through their own processes or in response to legal process (source).
The bot or wallet you used, through its official support channel only. Find the official links on its TAS Check page; fake support accounts appear fast after a drain.

5. Ignore anyone who offers to get it back

Theft victims are a target. The FBI warns about fake recovery services that reach out on social media, in comments and in search ads, ask for upfront fees, claim law-enforcement ties, and go quiet after the first payment (source). Private recovery companies can't issue seizure orders, and real law enforcement doesn't charge victims to investigate (source; source). Never share your seed phrase with anyone.

6. Before you connect anything again

Check the bot, exchange or wallet on TAS Check or with @TASCheckBot in Telegram: is the link official, who holds the key, what's the worst case.
Keep only trading money in any wallet a bot can touch, and use a separate wallet for long-term holdings: hardware wallets scored, and how to split vault, trading float and sweeps.
Watch the incident tracker for breaches at tools you use. A dated history of Telegram trading bot exploits is on Telegram trading bot hacks.
Planned: drain alerts on Telegram for the wallets your bots and agents use, from public addresses only. Not live yet; join the waitlist if you'd use it.
In the X posts we studied, most first-person losses came from bots holding people's keys, not from AI going rogue (the study).

Questions

Can a crypto transaction be reversed?

No. Onchain transactions can't be reversed, and a self-custodial wallet provider can't recover funds for you (MetaMask's guide says so directly). What you can still do is protect what's left, report the theft and flag the attacker's address.

Can a recovery company get my crypto back?

Be very careful. The FBI warns that fake recovery services target theft victims, ask for upfront fees and may claim to work with law enforcement. Private recovery companies can't issue seizure orders, and real law enforcement doesn't charge victims to investigate.

Should I import my old private key into a new wallet app?

No. If the key or seed was stolen, any wallet using it is exposed. Create a new wallet with a new seed and move what's left to it, then stop using the old one.

Does revoking token approvals help after a drain?

If the theft came from an approval you signed (common with phishing sites on EVM chains), yes: revoke it, because an approval can be used again later. If your private key was taken, revoking doesn't stop the thief: move funds to a new wallet.

Sources

General information, not financial or legal advice. Spot something wrong? Tell us.