{"investigation":{"slug":"banana-gun","entity_name":"Banana Gun","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.75,"status":"published","content_type":"investigation","summary":"Banana Gun is a Telegram-based crypto trading bot launched in 2023 that allows users to snipe token launches on EVM chains and Solana. The project has experienced two major security incidents: a smart contract bug at token launch in September 2023 that caused the BANANA token to crash 99.7%, and a $3 million exploit in September 2024 in which attackers leveraged a Telegram message oracle vulnerability to drain 11 users. Separate, unresolved allegations from on-chain researchers claim the team arranged an exclusive order flow deal with block builder Titan that funneled millions of dollars in user bribe payments away from Ethereum validators.","sections":[{"content":"Banana Gun is a Telegram-based crypto trading bot that automates token sniping and trading on Ethereum Virtual Machine (EVM) chains and Solana. It was developed by a largely anonymous team; one individual identified as 'Daniel' has been referenced as CEO and co-founder in promotional materials, though no further identifying information has been publicly disclosed. The bot grew rapidly between its launch in 2023 and late 2023, becoming one of the dominant Telegram trading bots by encouraging users to submit high priority bribes to get transactions included first in Ethereum blocks. The project subsequently launched a native token, BANANA, with a total supply capped at 10 million tokens. As of mid-2026, BANANA trades at a significantly diminished valuation relative to its post-relaunch open following the incidents described below.","heading":"Overview and Background","sources":[{"url":"https://bitkan.com/learn/what-is-banana-gun-and-is-it-a-good-investment-20808","name":"bitkan.com","type":"other","credibility":3},{"url":"https://www.shoal.gg/p/banana-gun-telegram-sniper-bot","name":"shoal.gg","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/banana-gun","name":"coingecko.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 11, 2023, Banana Gun launched the BANANA token, which reached a peak price of approximately $8.70 before collapsing to $0.02 — a decline of approximately 99.7% — within three hours of launch. The team disclosed a critical bug in the token's smart contract: a 4% transaction tax that was intended to route fees to the project treasury instead remained in the wallets of users initiating sell transactions. This allowed sellers to effectively keep the tax intended for the protocol. The flaw was identified within seconds by a pseudonymous user known as 'MisterChoc' using OpenAI's ChatGPT, despite the contract having allegedly passed two professional security audits prior to launch. The team subsequently drained the liquidity pool from its treasury, which held approximately 950 ETH (valued at roughly $1.5 million at the time), to prevent further exploitation. Community speculation about an intentional rug pull was elevated because the treasury drain occurred alongside the token collapse, though the team maintained that the action was taken to contain the bug. A relaunch followed: the team compensated holders through a combination of airdrops of new BANANA tokens and direct ETH refunds. In the first phase of its compensation plan, Banana Gun refunded 740 ETH to 591 wallets. The relaunched token opened at approximately $6.20 on Uniswap v2, with $2.1 million in liquidity locked for two years.","heading":"BANANA Token Launch Bug and 99.7% Crash (September 2023)","sources":[{"url":"https://www.web3isgoinggreat.com/?id=banana-gun-bot-flubbed-token-launch","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/250395/hyped-telegram-bot-banana-guns-team-dumps-treasury-after-token-bug","name":"theblock.co","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/banana-gun-failed-contract-passed-audits-but-chat-gpt-found-the-bug-in-seconds","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://beincrypto.com/crypto-project-banana-gun-contract-bug/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://tokeninsight.com/en/news/banana-gun-refunded-740-eth-to-591-wallets-in-first-phase-of-compensation","name":"tokeninsight.com","type":"other","credibility":3},{"url":"https://thedefiant.io/news/defi/hyped-banana-token-launch-wrecked-by-contract-bug","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://crypto.news/banana-guns-redemption-plan-after-banana-token-crash/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"Separate on-chain research published by pseudonymous analysts alleged that during the $PENGY token launch in August 2023, the Banana Gun team may have used proprietary access to user bribe data to frontrun its own users. In the incident, a user identified as 'baldisbasics.eth' paid 33 ETH in priority bribes to be the first buyer of the token, while a second user ('ballsdrainer.eth') paid a marginally smaller bribe. On-chain tracing allegedly connected the ENS addresses and funding wallets of baldisbasics.eth back to wallets associated with the Banana Bot's creation, including addresses labeled 'uniswapvillain.eth' and 'girlwantmeinheruterusfuckitimrichletsdoit.eth'. The first buyer reportedly profited over $100,000 while the second lost a similar amount. A wallet described as a 'Merging Wallet' allegedly connected to the development team ranked as the 4th highest Banana volume trader with approximately $853,846 in buy volume and $1,144,243 in sell volume. Banana Gun officially denied any connection between the team and 'baldisbasics.eth', characterizing the allegations as FUD. These allegations have not been confirmed by any independent regulatory body or court filing, and remain unverified at the Tier 3 source level from on-chain researchers.","heading":"Alleged Frontrunning of Users (August 2023)","sources":[{"url":"https://nothinginsignificant.substack.com/p/banana-bot-know-your-customer","name":"nothinginsignificant.substack.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain researchers have alleged that between 2023 and 2024, Banana Gun entered into an exclusive order flow arrangement with Ethereum block builder Titan Builder. According to this analysis, out of a total of 4,466.89 ETH paid by Banana Gun users in transaction bribe bundles, only 2,915.65 ETH was ultimately transferred to Ethereum block proposers (validators). Analysts allege that approximately 2,271.26 ETH was retained by Titan Builder under the exclusive arrangement, with a portion alleged to have been returned to private accounts connected to the Banana Gun team. The broader concern raised by researchers is that the arrangement allowed Titan Builder to rapidly expand its market share from under 1% to over 40% of Ethereum block production, while users who paid bribes expecting competitive block inclusion were allegedly receiving less value than anticipated. These claims originated primarily from Substack researchers and have not been substantiated by a court filing or regulatory body. Banana Gun has not publicly addressed these specific claims in detail.","heading":"Alleged ETH Siphoning via Titan Builder Exclusive Order Flow Arrangement","sources":[{"url":"https://nothinginsignificant.substack.com/p/banana-gun-holding-ethereum-hostage","name":"nothinginsignificant.substack.com","type":"other","credibility":3},{"url":"https://www.gate.com/learn/articles/how-the-banana-gun-siphoned-millions-of-dollars-from-users-and-ethereum-validators/3815","name":"gate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 19, 2024, Banana Gun users began reporting unauthorized outbound ETH transfers from their wallets while actively using the bot. Banana Gun took both its EVM and Solana bots offline and investigated. The team subsequently attributed the breach to a vulnerability in the Telegram message oracle component of the bot's infrastructure, which allowed the attacker to intercept messages and manually transfer ETH from victim wallets in real time. Unlike typical automated exploits, the attacker operated manually and selected targets with deliberate precision: all 11 confirmed victims were established, publicly recognized crypto traders, suggesting the attacker had profiled targets in advance. Initial reports estimated the loss at approximately $1.9 million, affecting a larger number of users, but the confirmed final figure was $3 million across 11 wallets. Banana Gun stated that all 11 affected users would be fully reimbursed from the project treasury, with no BANANA tokens sold to fund the repayments. Post-incident remediation included: patching the Telegram oracle vulnerability, redeploying bot infrastructure on fresh servers, implementing a mandatory two-hour transfer delay, adding two-factor authentication (2FA) for transfers, and engaging Security Alliance — a Web3 security firm — for additional penetration testing and audits.","heading":"$3 Million Telegram Oracle Exploit (September 2024)","sources":[{"url":"https://www.web3isgoinggreat.com/?id=banana-gun-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/banana-gun-crypto-bot-refunds-3m","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/318074/banana-gun-exploit-refund","name":"theblock.co","type":"other","credibility":3},{"url":"https://cryptonews.com/news/telegram-bot-banana-gun-to-refund-3-million-hack-victims/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/banana-gun-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://thedefiant.io/news/defi/banana-gun-pledges-to-pay-back-victims-of-usd3-million-exploit","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/banana-gun-refund-3-million-123118171.html","name":"finance.yahoo.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The September 2023 token launch bug exposed a fundamental weakness in the project's pre-launch audit process: despite two professional smart contract audits, the tax routing bug was not identified. The flaw was subsequently discovered in seconds by a non-expert user querying ChatGPT, raising questions about the thoroughness of the audits. The 2024 Telegram oracle exploit demonstrated a separate and distinct infrastructure vulnerability unrelated to the smart contracts. Post-2024-exploit, the team engaged Security Alliance for audits and penetration testing, added 2FA, and introduced transfer delays. However, the combination of a failed dual audit in 2023, a significant infrastructure hack in 2024, and unresolved allegations about validator payment practices and potential frontrunning leaves the platform's overall security posture a material risk factor for users.","heading":"Audit and Security Posture","sources":[{"url":"https://cointelegraph.com/news/banana-gun-failed-contract-passed-audits-but-chat-gpt-found-the-bug-in-seconds","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/banana-gun-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://cryptonews.com/news/telegram-bot-banana-gun-to-refund-3-million-hack-victims/","name":"cryptonews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Banana Gun team is largely anonymous. One individual identified as 'Daniel' has been referenced publicly as CEO and co-founder, but no surnames, LinkedIn profiles, or verifiable background information have been made available for this individual or any other team members. The team's anonymity is a recurring concern raised by community researchers, particularly given the allegations of frontrunning and the unexplained treasury dump during the 2023 token crash. While anonymity is common in crypto projects, its combination with the multiple incidents described above elevates the associated risk profile. No regulatory filings or enforcement actions have been publicly identified against the Banana Gun team as of the research date.","heading":"Team Anonymity and Transparency","sources":[{"url":"https://tokeninsight.com/en/coins/banana-gun/team","name":"tokeninsight.com","type":"other","credibility":3},{"url":"https://www.rootdata.com/Projects/detail/Banana%20Gun?k=OTIxNQ%3D%3D","name":"rootdata.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of mid-2026, Banana Gun remains an active trading bot operating across EVM chains and Solana. The BANANA token is listed on major exchanges including Binance (via HODLer Airdrops), with a circulating supply of approximately 4 million tokens and a fully diluted valuation in the range of $15-31 million USD depending on exchange and date. The platform has not faced public regulatory enforcement action. The project's user base has not been publicly quantified since the 2024 hack. Competing Telegram trading bots, including Unibot and Maestro, experienced similar oracle-style exploits in overlapping timeframes, suggesting a class of infrastructure vulnerability affecting the broader Telegram bot trading ecosystem.","heading":"Current Status and Market Position","sources":[{"url":"https://www.coingecko.com/en/coins/banana-gun","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/banana-gun/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.binance.com/en/support/announcement/introducing-banana-gun-banana-on-binance-hodler-airdrops-subscribe-your-bnb-to-simple-earn-252eaa5e7a8646e6a4461f6057a06af4","name":"binance.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-05","event":"Banana Gun bot launches on Telegram, targeting Ethereum token sniping. Team begins encouraging high priority bribe payments to gain transaction ordering advantage.","source":"","date_original":"2023-05-01"},{"date":"2023-08","event":"Alleged frontrunning incident during $PENGY token launch. On-chain researchers later allege that wallets connected to the Banana Gun development team sniped ahead of a user who paid $4,000 less in bribes, profiting over $100,000.","source":"","date_original":"2023-08-01"},{"date":"2023-09-11","event":"BANANA token launches on Ethereum. Price peaks at approximately $8.70 before crashing 99.7% to $0.02 within three hours due to a smart contract tax routing bug.","source":""},{"date":"2023-09-12","event":"Banana Gun team dumps approximately 950 ETH from treasury wallet to drain the liquidity pool, citing the contract bug. Community alleges potential rug pull; team maintains this was remediation. ChatGPT identifies the bug in seconds after two professional audits missed it.","source":""},{"date":"2023-09","event":"Banana Gun relaunches BANANA token on Uniswap v2 at $6.20 open with $2.1 million in locked liquidity. Airdrop and ETH compensation plan distributed: 740 ETH refunded to 591 wallets in the first phase.","source":"","date_original":"2023-09-01"},{"date":"2023-10","event":"Banana Gun allegedly concludes exclusive order flow arrangement with Titan Builder. Researchers later allege this arrangement enabled Titan to grow from under 1% to over 40% of Ethereum block production, while diverting millions in user bribe payments.","source":"","date_original":"2023-10-01"},{"date":"2024-09-19","event":"Banana Gun Telegram oracle exploit. Attacker exploits a vulnerability in the bot's Telegram message oracle, manually draining ETH from 11 experienced traders' wallets. Estimated loss: $3 million. Both EVM and Solana bots taken offline.","source":""},{"date":"2024-09-25","event":"Banana Gun confirms full $3 million reimbursement to all 11 exploit victims from the project treasury. No BANANA tokens sold to fund repayments. Security Alliance engaged for third-party audit. 2FA and two-hour transfer delays implemented.","source":""}],"sources_used":[{"url":"https://bitkan.com/learn/what-is-banana-gun-and-is-it-a-good-investment-20808","name":"bitkan.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.shoal.gg/p/banana-gun-telegram-sniper-bot","name":"shoal.gg","type":"other","archive_url":"http://web.archive.org/web/20260519163622/https://www.shoal.gg/p/banana-gun-telegram-sniper-bot","credibility":3,"archive_timestamp":"2026-05-19T16:36:22+00:00"},{"url":"https://www.coingecko.com/en/coins/banana-gun","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20260815013518/https://www.coingecko.com/en/coins/banana-gun","credibility":3,"archive_timestamp":"2026-08-15T01:35:18+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=banana-gun-bot-flubbed-token-launch","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20250916173206/https://www.web3isgoinggreat.com/?id=banana-gun-bot-flubbed-token-launch","credibility":3,"archive_timestamp":"2025-09-16T17:32:06+00:00"},{"url":"https://www.theblock.co/post/250395/hyped-telegram-bot-banana-guns-team-dumps-treasury-after-token-bug","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/banana-gun-failed-contract-passed-audits-but-chat-gpt-found-the-bug-in-seconds","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260829130038/https://cointelegraph.com/news/banana-gun-failed-contract-passed-audits-but-chat-gpt-found-the-bug-in-seconds","credibility":3,"archive_timestamp":"2026-08-29T13:00:38+00:00"},{"url":"https://beincrypto.com/crypto-project-banana-gun-contract-bug/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20250902001953/https://beincrypto.com/crypto-project-banana-gun-contract-bug//","credibility":3,"archive_timestamp":"2025-09-02T00:19:53+00:00"},{"url":"https://tokeninsight.com/en/news/banana-gun-refunded-740-eth-to-591-wallets-in-first-phase-of-compensation","name":"tokeninsight.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://thedefiant.io/news/defi/hyped-banana-token-launch-wrecked-by-contract-bug","name":"thedefiant.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/banana-guns-redemption-plan-after-banana-token-crash/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20250905191908/https://crypto.news/banana-guns-redemption-plan-after-banana-token-crash/","credibility":3,"archive_timestamp":"2025-09-05T19:19:08+00:00"},{"url":"https://nothinginsignificant.substack.com/p/banana-bot-know-your-customer","name":"nothinginsignificant.substack.com","type":"other","archive_url":"https://web.archive.org/web/20260830002404/https://nothinginsignificant.substack.com/p/banana-bot-know-your-customer","credibility":3,"archive_timestamp":"2026-08-30T00:24:04+00:00"},{"url":"https://nothinginsignificant.substack.com/p/banana-gun-holding-ethereum-hostage","name":"nothinginsignificant.substack.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.gate.com/learn/articles/how-the-banana-gun-siphoned-millions-of-dollars-from-users-and-ethereum-validators/3815","name":"gate.com","type":"other","archive_url":"https://web.archive.org/web/20260829151814/https://www.gate.com/learn/articles/how-the-banana-gun-siphoned-millions-of-dollars-from-users-and-ethereum-validators/3815","credibility":3,"archive_timestamp":"2026-08-29T15:18:14+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=banana-gun-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20251212152535/https://www.web3isgoinggreat.com/?id=banana-gun-exploit","credibility":3,"archive_timestamp":"2025-12-12T15:25:35+00:00"},{"url":"https://cointelegraph.com/news/banana-gun-crypto-bot-refunds-3m","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260216144523/https://cointelegraph.com/news/banana-gun-crypto-bot-refunds-3m","credibility":3,"archive_timestamp":"2026-02-16T14:45:23+00:00"},{"url":"https://www.theblock.co/post/318074/banana-gun-exploit-refund","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cryptonews.com/news/telegram-bot-banana-gun-to-refund-3-million-hack-victims/","name":"cryptonews.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.quillaudits.com/blog/hack-analysis/banana-gun-exploit","name":"quillaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260611074327/https://www.quillaudits.com/blog/hack-analysis/banana-gun-exploit","credibility":3,"archive_timestamp":"2026-06-11T07:43:27+00:00"},{"url":"https://thedefiant.io/news/defi/banana-gun-pledges-to-pay-back-victims-of-usd3-million-exploit","name":"thedefiant.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://finance.yahoo.com/news/banana-gun-refund-3-million-123118171.html","name":"finance.yahoo.com","type":"other","archive_url":"http://web.archive.org/web/20251004122936/https://finance.yahoo.com/news/banana-gun-refund-3-million-123118171.html","credibility":3,"archive_timestamp":"2025-10-04T12:29:36+00:00"},{"url":"https://tokeninsight.com/en/coins/banana-gun/team","name":"tokeninsight.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.rootdata.com/Projects/detail/Banana%20Gun?k=OTIxNQ%3D%3D","name":"rootdata.com","type":"other","archive_url":"http://web.archive.org/web/20260830010139/https://www.rootdata.com/Projects/detail/Banana%20Gun?k=OTIxNQ%3D%3D","credibility":3,"archive_timestamp":"2026-08-30T01:01:39+00:00"},{"url":"https://coinmarketcap.com/currencies/banana-gun/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260815013519/https://coinmarketcap.com/currencies/banana-gun/","credibility":3,"archive_timestamp":"2026-08-15T01:35:19+00:00"},{"url":"https://www.binance.com/en/support/announcement/introducing-banana-gun-banana-on-binance-hodler-airdrops-subscribe-your-bnb-to-simple-earn-252eaa5e7a8646e6a4461f6057a06af4","name":"binance.com","type":"other","archive_url":"https://web.archive.org/web/20260830044728/https://www.binance.com/en/support/announcement/detail/252eaa5e7a8646e6a4461f6057a06af4?hl=en&ref=CPA_0080LWTMLN&utm_medium=app_share_link_twitter&utm_source=new_share","credibility":3,"archive_timestamp":"2026-08-30T04:47:28+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:29.20868+00:00","updated_at":"2026-08-30T05:14:06.24562+00:00"}}