Verified security incidents at bots in our directory: what happened, how many users were hit, the estimated loss and whether people got their money back. Every entry links its sources.
Loss figures are the estimates named in the sources (often on-chain analysts), not our own measurements. Refund status is what the operator or reporters said; we can’t audit payouts. RSS feed · /api/incidents.json · Watch a bot from its page to get an urgent email when a new incident is added.
TradeWiz disclosed a “limited private key exposure” in the private-key export feature of SOL PVP, its Solana copy-trading web app. On-chain analysis traced draining from Sept 28 (a small test) to Oct 1. TradeWiz said its SOL Bot, Robin PVP and BSC PVP were not affected, paused its EVM services and reported the case to police on Oct 1.
Affected
20,932 wallets touched, 20,793 of them lost SOL (Bitquery count, corrected Oct 15, 2026)
Estimated loss
About $439K–$459K in SOL (third-party estimates: ~$438.9K by an independent researcher, ~$459.5K by Bitquery at $120/SOL). TradeWiz published no total.
Refunds
Partial refunds reported; completion not independently verifiedTradeWiz said it would fully compensate verified losses and on Sept 30 posted that the first wave of refunds had been sent. We have not seen an independent confirmation that all refunds are complete.
Attackers manually transferred ETH out of bot wallets belonging to experienced traders. Banana Gun traced it to a vulnerability in the Telegram message oracle the bot uses, paused the bot, then reactivated it with new protections, including a transfer delay and two-factor confirmation for transfers.
Affected
11 users (Banana Gun's post-mortem; early reports said 36 wallets)
Estimated loss
About $3M (563 ETH), per Banana Gun
Refunds
Refunds promised; completion not independently verifiedBanana Gun said all affected users would be fully refunded from its treasury, without selling tokens.
An attacker abused token approvals that users had given Unibot's new router contract and swapped the stolen tokens for ETH. CertiK noted a very similar attack on Maestro a week earlier.
Affected
About 600 wallets (per Unibot, as reported by CryptoPotato)
Estimated loss
About 355.5 ETH (~$640K), per CertiK
Refunds
Refunds reported as completedUnibot reported that it fully compensated affected users, spending about $1.78M.
An attacker used a flaw in Maestro's Router2 contract to transfer tokens that users had approved the contract to spend, then swapped them for ETH. Maestro patched the router.
Affected
106 users (per CertiK)
Estimated loss
About 280 ETH (~$500K), per The Block and CertiK
Refunds
Refunds promised; completion not independently verifiedThe team said it would refund affected users.
After months of user reports of unauthorized trades on linked exchange accounts, an anonymous person leaked a database of 3Commas users' exchange API keys. 3Commas confirmed that users' API keys, secrets and passphrases had been disclosed, asked Binance, KuCoin and other exchanges to revoke all keys connected to 3Commas, and urged users to reissue their keys. CoinDesk reported the FBI was investigating.
Affected
About 100,000 Binance and KuCoin API keys (per CoinDesk)
Estimated loss
Not quantified by 3Commas. A victims' group leader told CoinDesk he tallied the group's losses at over $20M (unverified).
Refunds
No refund announced in the sources we checkedWe found no refund program in 3Commas's notice.