{"meta":{"publisher":"BotOrNot","site":"https://getbotornot.com/","docs":"https://getbotornot.com/api/","openapi":"https://getbotornot.com/openapi.json","generated_at":"2026-10-16T05:18:47.351Z","disclosure":"Not investment advice. BotOrNot earns affiliate commissions from some outbound links (currently Hyperliquid referral links, https://app.hyperliquid.xyz/join/AMPLIFY, labeled on the site); payouts never change a listing, ranking or warning. Full disclosure: https://getbotornot.com/about/#disclosure","count":6,"rss":"https://getbotornot.com/incidents/rss.xml","page":"https://getbotornot.com/incidents/","inclusion_rule":"Incidents at bots in the BotOrNot directory where users' funds or keys were affected, confirmed by the operator or by at least two independent sources.","refund_status_values":{"refunded_reported":"Refunds reported as completed","promised":"Refunds promised; completion not independently verified","in_progress_reported":"Partial refunds reported; completion not independently verified","none_reported":"No refund announced in the sources we checked","not_applicable":"No quantified user loss reported"},"type_values":{"key_exposure":"Private-key exposure","contract_exploit":"Router contract exploit","oracle_exploit":"Bot infrastructure exploit","api_key_leak":"API key leak"},"filter":"Add ?bot={slug} for one bot.","note":"Verified security incidents involving trading bots. Each entry cites its sources; loss figures are the estimates named in those sources (often third-party on-chain analysis), not BotOrNot measurements. Refund status reflects what the sources report, not an independent audit of payouts. Entries marked backfilled were added when the tracker launched and never triggered an alert."},"incidents":[{"id":"tradewiz-2026-09-30","bot":"tradewiz","bot_name":"TradeWiz","date":"2026-09-30","date_precision":"day","type":"key_exposure","type_label":"Private-key exposure","title":"TradeWiz SOL PVP private-key exposure","what_happened":"TradeWiz disclosed a “limited private key exposure” in the private-key export feature of SOL PVP, its Solana copy-trading web app. On-chain analysis traced draining from Sept 28 (a small test) to Oct 1. TradeWiz said its SOL Bot, Robin PVP and BSC PVP were not affected, paused its EVM services and reported the case to police on Oct 1.","wallets_affected":"20,932 wallets touched, 20,793 of them lost SOL (Bitquery count, corrected Oct 15, 2026)","loss":"About $439K–$459K in SOL (third-party estimates: ~$438.9K by an independent researcher, ~$459.5K by Bitquery at $120/SOL). TradeWiz published no total.","loss_usd_high":459468,"refund_status":"in_progress_reported","refund_label":"Partial refunds reported; completion not independently verified","refund_note":"TradeWiz said it would fully compensate verified losses and on Sept 30 posted that the first wave of refunds had been sent. We have not seen an independent confirmation that all refunds are complete.","sources":[{"label":"TradeWiz security notice (X)","url":"https://x.com/TradeWiz_Bot/status/2105307161907577159","kind":"operator"},{"label":"TradeWiz refund update (X)","url":"https://x.com/TradeWiz_Bot/status/2105359189262598537","kind":"operator"},{"label":"TradeWiz Oct 1 update (X)","url":"https://x.com/TradeWiz_Bot/status/2105561995290575183","kind":"operator"},{"label":"Bitquery investigation","url":"https://bitquery.io/investigations/tradewiz-hack","kind":"analysis"},{"label":"Bitcoin.com News","url":"https://news.bitcoin.com/security/the-459000-bot-hacker-was-a-customer-first-researchers-say/","kind":"news"},{"label":"CrossMeme incident guide","url":"https://crossmeme.app/guides/tradewiz-security-incident","kind":"news"}],"backfilled":true,"added_at":"2026-10-15","report_card":"Caution","url":"https://getbotornot.com/incidents/#tradewiz-2026-09-30","bot_page_url":"https://getbotornot.com/bots/tradewiz/","bot_api_url":"https://getbotornot.com/api/bots/tradewiz.json"},{"id":"banana-gun-2024-09-19","bot":"banana-gun","bot_name":"Banana Gun","date":"2024-09-19","date_precision":"day","type":"oracle_exploit","type_label":"Bot infrastructure exploit","title":"Banana Gun Telegram message-oracle exploit","what_happened":"Attackers manually transferred ETH out of bot wallets belonging to experienced traders. Banana Gun traced it to a vulnerability in the Telegram message oracle the bot uses, paused the bot, then reactivated it with new protections, including a transfer delay and two-factor confirmation for transfers.","wallets_affected":"11 users (Banana Gun's post-mortem; early reports said 36 wallets)","loss":"About $3M (563 ETH), per Banana Gun","loss_usd_high":3000000,"refund_status":"promised","refund_label":"Refunds promised; completion not independently verified","refund_note":"Banana Gun said all affected users would be fully refunded from its treasury, without selling tokens.","sources":[{"label":"The Block","url":"https://www.theblock.co/news/ecosystems/2024-09-25-banana-gun-exploit-refund-318074","kind":"news"},{"label":"Cointelegraph","url":"https://cointelegraph.com/news/banana-gun-crypto-bot-refunds-3m","kind":"news"}],"backfilled":true,"added_at":"2026-10-15","report_card":"Caution","url":"https://getbotornot.com/incidents/#banana-gun-2024-09-19","bot_page_url":"https://getbotornot.com/bots/banana-gun/","bot_api_url":"https://getbotornot.com/api/bots/banana-gun.json"},{"id":"solareum-2024-03","bot":"solareum","bot_name":"Solareum","date":"2024-03-29","date_precision":"month","type":"key_exposure","type_label":"Private-key exposure","title":"Solareum wallets drained; bot shut down","what_happened":"Wallets of Solareum bot users were drained in late March 2024. The team shut the bot down days later.","wallets_affected":"300+ users (per Decrypt)","loss":"About $523K in SOL (per Decrypt, citing on-chain data)","loss_usd_high":523000,"refund_status":"none_reported","refund_label":"No refund announced in the sources we checked","refund_note":"Decrypt reported the team said nothing about compensating users.","sources":[{"label":"Decrypt","url":"https://decrypt.co/224371/solana-telegram-trading-bot-shut-down-users-drained-523k","kind":"news"},{"label":"Cointelegraph","url":"https://cointelegraph.com/news/telegram-trading-bot-solareum-shutters-after-520k-exploit","kind":"news"}],"backfilled":true,"added_at":"2026-10-15","report_card":"Closed","url":"https://getbotornot.com/incidents/#solareum-2024-03","bot_page_url":"https://getbotornot.com/bots/solareum/","bot_api_url":"https://getbotornot.com/api/bots/solareum.json"},{"id":"unibot-2023-10-31","bot":"unibot","bot_name":"Unibot","date":"2023-10-31","date_precision":"day","type":"contract_exploit","type_label":"Router contract exploit","title":"Unibot router token-approval exploit","what_happened":"An attacker abused token approvals that users had given Unibot's new router contract and swapped the stolen tokens for ETH. CertiK noted a very similar attack on Maestro a week earlier.","wallets_affected":"About 600 wallets (per Unibot, as reported by CryptoPotato)","loss":"About 355.5 ETH (~$640K), per CertiK","loss_usd_high":640000,"refund_status":"refunded_reported","refund_label":"Refunds reported as completed","refund_note":"Unibot reported that it fully compensated affected users, spending about $1.78M.","sources":[{"label":"CertiK","url":"https://www.certik.com/blog/maestro-and-unibot","kind":"analysis"},{"label":"CryptoPotato","url":"https://cryptopotato.com/unibot-fully-compensates-users-following-hacking-incident/","kind":"news"}],"backfilled":true,"added_at":"2026-10-15","report_card":"Caution","url":"https://getbotornot.com/incidents/#unibot-2023-10-31","bot_page_url":"https://getbotornot.com/bots/unibot/","bot_api_url":"https://getbotornot.com/api/bots/unibot.json"},{"id":"maestro-2023-10-24","bot":"maestro","bot_name":"Maestro","date":"2023-10-24","date_precision":"day","type":"contract_exploit","type_label":"Router contract exploit","title":"Maestro Router2 contract exploit","what_happened":"An attacker used a flaw in Maestro's Router2 contract to transfer tokens that users had approved the contract to spend, then swapped them for ETH. Maestro patched the router.","wallets_affected":"106 users (per CertiK)","loss":"About 280 ETH (~$500K), per The Block and CertiK","loss_usd_high":500000,"refund_status":"promised","refund_label":"Refunds promised; completion not independently verified","refund_note":"The team said it would refund affected users.","sources":[{"label":"The Block","url":"https://www.theblock.co/post/259338/maestro-telegram-bot-suffers-a-contract-exploit-500000-of-eth-stolen","kind":"news"},{"label":"CertiK","url":"https://www.certik.com/blog/maestro-and-unibot","kind":"analysis"}],"backfilled":true,"added_at":"2026-10-15","report_card":"Caution","url":"https://getbotornot.com/incidents/#maestro-2023-10-24","bot_page_url":"https://getbotornot.com/bots/maestro/","bot_api_url":"https://getbotornot.com/api/bots/maestro.json"},{"id":"3commas-2022-12-28","bot":"3commas","bot_name":"3Commas","date":"2022-12-28","date_precision":"day","type":"api_key_leak","type_label":"API key leak","title":"3Commas API key leak","what_happened":"After months of user reports of unauthorized trades on linked exchange accounts, an anonymous person leaked a database of 3Commas users' exchange API keys. 3Commas confirmed that users' API keys, secrets and passphrases had been disclosed, asked Binance, KuCoin and other exchanges to revoke all keys connected to 3Commas, and urged users to reissue their keys. CoinDesk reported the FBI was investigating.","wallets_affected":"About 100,000 Binance and KuCoin API keys (per CoinDesk)","loss":"Not quantified by 3Commas. A victims' group leader told CoinDesk he tallied the group's losses at over $20M (unverified).","loss_usd_high":null,"refund_status":"none_reported","refund_label":"No refund announced in the sources we checked","refund_note":"We found no refund program in 3Commas's notice.","sources":[{"label":"3Commas notice","url":"https://3commas.io/blog/notice-on-api-data-disclosure-incident","kind":"operator"},{"label":"CoinDesk","url":"https://www.coindesk.com/business/2022/12/29/fbi-investigating-3commas-data-breach","kind":"news"}],"backfilled":true,"added_at":"2026-10-15","report_card":"Caution","url":"https://getbotornot.com/incidents/#3commas-2022-12-28","bot_page_url":"https://getbotornot.com/bots/3commas/","bot_api_url":"https://getbotornot.com/api/bots/3commas.json"}]}