Telegram trading bots are hot, but don’t trust them for custody — Security firms

[NewspaperD2]

Blockchain security experts are raising red flags about the security practices of Telegram trading bots, which are transforming the messaging platform into a pseudo-crypto marketplace. These bots present considerable security concerns for users and warrant closer examination, according to blockchain security firms.

Although these trading bots have been in existence for years, they have recently garnered attention due to the surge in crypto market activity and the increasing value of associated bot tokens, as highlighted by blockchain security firm CertiK in conversation with Cointelegraph.

Presently, the collective market capitalization of Telegram bot tokens is approaching the $250 million mark, as reported by CoinGecko. Among these tokens, Unibot takes the lead in terms of size, accompanied by other popular options like Wagie Bot and Mizar.

These bots operate as automated programs within the Telegram platform, permitting users to execute trades on decentralized exchanges (DEXs) by interacting with them through the messaging app.

CertiK, however, has issued a warning that numerous Telegram bots generate cryptocurrency wallets for users, but only a fraction of them actually provide the private key necessary for true ownership and control.

The whereabouts of these private keys are uncertain—whether they are accessible to project personnel, stored on users' devices, or backed up via Telegram.

"While these platforms offer high-volume DEX trading options, they should be considered extremely high-risk and unsuitable for medium to long-term storage of assets," cautioned CertiK.

Unibot, boasting a market capitalization surpassing $185 million, emerges as the largest Telegram bot token in terms of market value. Recent data from Dune Analytics reveals that Unibot users have conducted trades worth $155 million across more than 230,000 transactions using the bot. Notably, there is a noticeable trading volume surge among Unibot users since late May, particularly peaking around late July.

In an August 5th statement, blockchain security firm Beosin echoed concerns about the security vulnerabilities associated with these bots, particularly emphasizing the risks linked to their centralized nature in relation to users' private wallet keys. Beosin also highlighted the lack of open-sourced code and security audits among many of these bots, underscoring that compromised user funds could result from a hacked Telegram account.

As a solution, Beosin recommended that projects open-source their code to facilitate security reviews and ensure more robust storage of user private keys.