{"investigation":{"slug":"sigma-bot","entity_name":"SIGMA Bot","trust_score":4,"severity_base":null,"score_modifier":-18,"confidence":0.72,"status":"published","content_type":"investigation","summary":"SIGMA is a multi-chain Telegram trading bot operating at sigma.win that supports Ethereum, BSC, Base, Solana, Avalanche, and other networks. On May 11, 2026, a crypto trader known as Unihax0r suffered a private key compromise draining over $200,000 across Ethereum, Base, and BSC, with both affected wallets traceable exclusively to SIGMA's wallet generation infrastructure. SIGMA has published no post-mortem, security advisory, or public statement in response to the incident as of late May 2026.","sections":[{"content":"On May 11, 2026, between approximately 00:37 and 00:56 UTC, an attacker drained over $200,000 in crypto assets from wallets belonging to a trader identified as Unihax0r (@0xUnihax0r on X). The drain occurred across three chains simultaneously: approximately $125,000 in $POD tokens on Base, approximately $21,000 in $FHE tokens on BSC, and ETH plus minor token holdings on Ethereum. The total execution window was 10 to 30 minutes. At 01:53 UTC, Unihax0r publicly disclosed the attack on X, sharing the attacker's destination wallet address (0xF7cFFC27732a5C9c4E2D592F3E33435F8dDb019A) and requesting community assistance in tracing the funds. On-chain analyst @k0braca1 determined the attack was a private key compromise rather than a smart contract exploit, noting the absence of malicious token approvals and stating that the attacker had 'full control over signing operations across multiple chains.' The attacker pre-seeded the Ethereum wallet with small amounts of ETH to cover gas fees before sweeping remaining token balances, a technique consistent with prepared private key exploitation. Post-drain, assets were moved to attacker-controlled externally owned accounts, with on-chain traces indicating mixing and tumbling activity, rendering recovery unlikely.","heading":"May 11, 2026 Private Key Compromise and Multi-Chain Drain","sources":[{"url":"https://www.cryptotimes.io/2026/05/11/crypto-trader-drained-of-200k-in-telegram-bot-linked-crypto-hack/","name":"Crypto Trader Drained of $200K in Telegram Bot Linked Crypto Hack — CryptoTimes","type":"news_article","credibility":2},{"url":"https://cryptonews.net/news/security/32844596/","name":"SIGMA bot blamed as attacker drains $200K from trader's wallets — CryptoNews.net","type":"news_article","credibility":2},{"url":"https://www.mexc.com/news/1083127","name":"SIGMA bot blamed as attacker drains $200K from trader's wallets — MEXC News","type":"news_article","credibility":2},{"url":"https://crypto-economy.com/crypto-trader-loses-200k-after-telegram-bot-allegedly-exposes-private-keys/","name":"Crypto Trader Loses $200K After Telegram Bot Allegedly Exposes Private Keys — Crypto Economy","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The most forensically significant finding in the incident is that both drained wallets were originally generated via the SIGMA Telegram trading bot and subsequently imported into GMGN (a secondary Telegram trading tool) and Rabby Wallet. Critically, other wallets held by the same trader that were created through different platforms — including wallets in Rabby and Jupiter that were not generated through SIGMA — were not drained. This pattern strongly suggests the key material was compromised at the point of origin or within SIGMA's infrastructure, rather than through the victim's downstream wallet management tools or device environment. Community investigators and on-chain analysts cited this divergence as the primary basis for attributing the root cause to SIGMA. Unihax0r also confirmed that no suspicious Telegram sessions were detected on his account at the time of the attack, which complicates phishing as a sole explanation and increases the plausibility of server-side key exposure.","heading":"SIGMA as the Common Denominator: Wallet Origin Analysis","sources":[{"url":"https://www.cryptotimes.io/2026/05/11/crypto-trader-drained-of-200k-in-telegram-bot-linked-crypto-hack/","name":"Crypto Trader Drained of $200K in Telegram Bot Linked Crypto Hack — CryptoTimes","type":"news_article","credibility":2},{"url":"https://cryptonews.net/news/security/32844596/","name":"SIGMA bot blamed as attacker drains $200K from trader's wallets — CryptoNews.net","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/crypto-trader-loses-200k-telegram-bot/","name":"Crypto trader loses $200K after Telegram bot leaks private keys — Cryptopolitan","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Community investigators proposed several possible attack vectors, none of which have been confirmed by SIGMA or any independent security firm as of late May 2026. The alleged vectors include: (1) Telegram-based phishing via malicious CAPTCHA bots that reportedly appear during interaction with SIGMA; (2) malware or infostealer infections on the victim's device; (3) device compromise; (4) malicious browser extensions; and (5) a fake GMGN workflow. The unresolved ambiguity across these vectors reflects a broader structural problem with Telegram-native trading bots: private keys generated through such bots are created and initially stored within the bot's centralized server infrastructure. Security researchers at Hacken have noted that 'most Telegram bots are closed-source and unaudited, leaving users to trust anonymous teams with their private keys and funds.' ForkLog security researchers similarly warned that Telegram bots 'could potentially lead to asset losses and are not safeguarded against hacker attacks.' SIGMA's own documentation does not publicly detail how private keys are encrypted, stored, or isolated server-side, nor does it disclose whether the platform has undergone any third-party security audit.","heading":"Alleged Attack Vectors and Structural Key Management Risk","sources":[{"url":"https://www.cryptotimes.io/2026/05/11/crypto-trader-drained-of-200k-in-telegram-bot-linked-crypto-hack/","name":"Crypto Trader Drained of $200K in Telegram Bot Linked Crypto Hack — CryptoTimes","type":"news_article","credibility":2},{"url":"https://hacken.io/discover/telegram-crypto-trading-bots-risks/","name":"Telegram Crypto Trading Bots: Convenience vs. Security Risks — Hacken","type":"research","credibility":2},{"url":"https://www.mexc.com/news/1083127","name":"SIGMA bot blamed as attacker drains $200K from trader's wallets — MEXC News","type":"news_article","credibility":2}],"severity":"high"},{"content":"As of late May 2026, SIGMA has published no post-mortem report, security advisory, official statement, or acknowledgment of the May 11, 2026 incident across its documented channels — including its Telegram support group (t.me/SigmaBotPortal), its documentation site (docs.sigma.win), or its X/Twitter presence. None of the multiple news outlets covering the incident (CryptoTimes, CryptoNews.net, MEXC News, Crypto Economy, Cryptopolitan) cited any response from SIGMA. This silence stands in contrast to how comparable incidents have been handled: Banana Gun, after its September 2024 Telegram oracle exploit that resulted in approximately $3 million in losses, published a post-mortem, took its bot offline for remediation, and committed to full user reimbursement. SIGMA's lack of response is a significant transparency gap, as it leaves users without guidance on whether the vulnerability has been patched, whether other wallets may be at risk, or whether any remediation is underway.","heading":"Absence of Post-Mortem or Official Response","sources":[{"url":"https://cryptonews.net/news/security/32844596/","name":"SIGMA bot blamed as attacker drains $200K from trader's wallets — CryptoNews.net","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/banana-gun-crypto-bot-refunds-3m","name":"Telegram bot Banana Gun to absorb $3M loss from hack — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/05/11/crypto-trader-drained-of-200k-in-telegram-bot-linked-crypto-hack/","name":"Crypto Trader Drained of $200K in Telegram Bot Linked Crypto Hack — CryptoTimes","type":"news_article","credibility":2}],"severity":"high"},{"content":"SIGMA's team identity is not publicly disclosed. The platform's official documentation at docs.sigma.win describes the product as 'the culmination of months of dedicated effort by a team of professional coders and seasoned snipers' but names no individuals. No founders, executives, lead developers, or corporate entity are identified on the platform's website (sigma.win), documentation, or in any Tier 1 or Tier 2 media sources. The terms and conditions page (sigma.win/terms-conditions.html) was not publicly accessible at the time of this investigation. Third-party review sources including CoinCodeCap, DeFiPill, and BaseTrading Bots do not identify the team. This is a notable risk factor: in the context of a platform that holds or generates private key material for user wallets, anonymous or undisclosed team identity compounds the difficulty of accountability, legal recourse, and independent security verification.","heading":"Team Identity and Transparency","sources":[{"url":"https://docs.sigma.win/","name":"Sigma User Guide — docs.sigma.win","type":"official","credibility":2},{"url":"https://coincodecap.com/sigma-bot-review","name":"Sigma Bot Review (May 2026) — CoinCodeCap","type":"research","credibility":2},{"url":"https://defipill.xyz/telegram-trading-bots/sigma_review/","name":"Sigma Review (2026) — DeFiPill","type":"research","credibility":3}],"severity":"high"},{"content":"SIGMA operates primarily as a Telegram-native trading bot accessible via t.me/Sigma_buyBot, with a companion web terminal at sigma.win. The platform supports multi-chain trading across Ethereum, Avalanche, BSC, Base, Unichain, Berachain, and Solana. Core features include token sniping (auto-buying tokens at listing), copy trading, MEV and blockchain re-org protection, an anti-rug detection system, and support for up to 10 wallets per user. The platform charges a 1% fee per transaction on all supported chains. SIGMA's own documentation states that upon the first /start command, the bot generates a fresh wallet for the user, with private keys displayed once for the user to record. The documentation warns that private keys cannot be recovered if lost, and CoinCodeCap confirms no recovery mechanism or compensation exists for lost private keys. The platform claims to use 'battle-tested code' but has published no audits verifying this claim.","heading":"Platform Features and Operational Scope","sources":[{"url":"https://docs.sigma.win/","name":"Welcome to Sigma! — docs.sigma.win","type":"official","credibility":2},{"url":"https://docs.sigma.win/other-info/key-features","name":"Key Features — Sigma User Guide","type":"official","credibility":2},{"url":"https://coincodecap.com/sigma-bot-review","name":"Sigma Bot Review (May 2026) — CoinCodeCap","type":"research","credibility":2},{"url":"https://defidatachain.com/posts/how-to-use-sigma-multi-chain-telegram-trading-bot","name":"How to Use Sigma Multi-Chain Telegram Trading Bot — DeFiDataChain","type":"other","credibility":3}],"severity":"medium"},{"content":"The SIGMA incident reflects a broader, documented systemic risk in the Telegram-native trading bot sector. When users generate wallets through Telegram bots, private keys are created within server-side infrastructure controlled by the bot operator. Hacken has noted that once such infrastructure is compromised, or data is leaked, 'attackers can export private keys in bulk and drain all user funds at once.' The sector has a documented history of material incidents: Unibot suffered a router contract exploit in October 2023 resulting in approximately $640,000 in losses; Banana Gun suffered a Telegram message oracle exploit in September 2024 resulting in approximately $3 million in losses (later reimbursed); and Polycule, a Telegram bot on Polymarket, was hacked in January 2026 with approximately $230,000 stolen. SIGMA's incident shares structural characteristics with the Banana Gun case in that the key compromise was cross-chain and rapid, suggesting that server-side access — rather than a targeted phishing attack on one user — may be the more parsimonious explanation, though this has not been confirmed. Telegram group malware scams also increased by an alleged 2,000% between November 2024 and January 2025, creating a broader phishing threat ecosystem around platforms like SIGMA.","heading":"Systemic Risk: Telegram Bot Private Key Custody Model","sources":[{"url":"https://hacken.io/discover/telegram-crypto-trading-bots-risks/","name":"Telegram Crypto Trading Bots: Convenience vs. Security Risks — Hacken","type":"research","credibility":2},{"url":"https://thedefiant.io/news/defi/hacker-ransacks-usd600-000-from-popular-telegram-trading-bot-unibot","name":"Hacker Ransacks $600,000 From Popular Telegram Trading Bot, Unibot — The Defiant","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/banana-gun-crypto-bot-refunds-3m","name":"Telegram bot Banana Gun to absorb $3M loss from hack — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/telegram-trading-bot-polycule-on-polymarket-hacked-230k-stolen","name":"Telegram Trading Bot Polycule on Polymarket Hacked, $230K Stolen — KuCoin","type":"news_article","credibility":2},{"url":"https://www.bitget.com/academy/telegram-crypto-bots-8","name":"Telegram Crypto Trading Bots: Security Risks & Safety Guide 2026 — Bitget","type":"research","credibility":2}],"severity":"high"},{"content":"As of late May 2026, no regulatory actions, SEC filings, CFTC proceedings, DOJ investigations, or civil lawsuits related to SIGMA or sigma.win have been identified through public records searches. The absence of such actions does not constitute a clean bill of health; the platform's anonymous team structure and non-US apparent jurisdiction may limit regulatory visibility. No law enforcement agency has publicly named SIGMA or its operators in connection with the May 2026 incident or any prior event.","heading":"No Regulatory Actions or Legal Filings Identified","sources":[],"severity":"low"}],"timeline":[{"date":"2024-09-19","event":"Banana Gun Telegram bot exploited via Telegram message oracle vulnerability; approximately $3 million drained from 11 users. Bot issued post-mortem and reimbursed all affected users — establishing an industry precedent SIGMA has not followed.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/banana-gun-crypto-bot-refunds-3m"},{"date":"2026-01-13","event":"Polycule, a Telegram trading bot on Polymarket, hacked for approximately $230,000.","source":"KuCoin News","source_url":"https://www.kucoin.com/news/flash/telegram-trading-bot-polycule-on-polymarket-hacked-230k-stolen"},{"date":"2026-05-11","event":"Between 00:37 and 00:56 UTC, attacker drains over $200,000 from two wallets belonging to trader Unihax0r across Ethereum, Base, and BSC. Both wallets were created exclusively through SIGMA. Attack confirmed as private key compromise, not a smart contract exploit.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/05/11/crypto-trader-drained-of-200k-in-telegram-bot-linked-crypto-hack/"},{"date":"2026-05-11","event":"At 01:53 UTC, Unihax0r posts publicly on X: 'Just got drained or hacked for more than 200k. Sick to my stomach.' Shares attacker wallet address 0xF7cFFC27732a5C9c4E2D592F3E33435F8dDb019A.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/05/11/crypto-trader-drained-of-200k-in-telegram-bot-linked-crypto-hack/"},{"date":"2026-05-11","event":"On-chain analyst @k0braca1 publicly states the attack bears hallmarks of private key leakage with full signing control across chains, ruling out malicious approvals.","source":"Crypto Economy","source_url":"https://crypto-economy.com/crypto-trader-loses-200k-after-telegram-bot-allegedly-exposes-private-keys/"},{"date":"2026-05-11","event":"Multiple crypto news outlets including CryptoTimes, CryptoNews.net, MEXC News, Crypto Economy, and Cryptopolitan publish coverage of the incident, all noting SIGMA's silence.","source":"CryptoNews.net","source_url":"https://cryptonews.net/news/security/32844596/"},{"date":"2026-05-31","event":"As of this date, SIGMA has issued no public statement, post-mortem, security advisory, or acknowledgment of the incident across any documented channel.","source":"AVOID.NET investigation (confirmed via multi-source search)","source_url":"https://www.cryptotimes.io/2026/05/11/crypto-trader-drained-of-200k-in-telegram-bot-linked-crypto-hack/"}],"sources_used":[{"url":"https://www.cryptotimes.io/2026/05/11/crypto-trader-drained-of-200k-in-telegram-bot-linked-crypto-hack/","name":"Crypto Trader Drained of $200K in Telegram Bot Linked Crypto Hack — CryptoTimes","type":"news_article","archive_url":"https://web.archive.org/web/20260726044503/https://www.cryptotimes.io/2026/05/11/crypto-trader-drained-of-200k-in-telegram-bot-linked-crypto-hack/","credibility":2,"archive_timestamp":"2026-07-26T04:45:03+00:00"},{"url":"https://cryptonews.net/news/security/32844596/","name":"SIGMA bot blamed as attacker drains $200K from trader's wallets — CryptoNews.net","type":"news_article","archive_url":"https://web.archive.org/web/20260725140154/https://cryptonews.net/news/security/32844596/","credibility":2,"archive_timestamp":"2026-07-25T14:01:54+00:00"},{"url":"https://www.mexc.com/news/1083127","name":"SIGMA bot blamed as attacker drains $200K from trader's wallets — MEXC News","type":"news_article","archive_url":"http://web.archive.org/web/20260725212913/https://www.mexc.com/news/1083127","credibility":2,"archive_timestamp":"2026-07-25T21:29:13+00:00"},{"url":"https://crypto-economy.com/crypto-trader-loses-200k-after-telegram-bot-allegedly-exposes-private-keys/","name":"Crypto Trader Loses $200K After Telegram Bot Allegedly Exposes Private Keys — Crypto Economy","type":"news_article","archive_url":"https://web.archive.org/web/20260725201733/https://crypto-economy.com/crypto-trader-loses-200k-after-telegram-bot-allegedly-exposes-private-keys/","credibility":2,"archive_timestamp":"2026-07-25T20:17:33+00:00"},{"url":"https://www.cryptopolitan.com/crypto-trader-loses-200k-telegram-bot/","name":"Crypto trader loses $200K after Telegram bot leaks private keys — Cryptopolitan","type":"news_article","archive_url":"https://web.archive.org/web/20260726044048/https://www.cryptopolitan.com/crypto-trader-loses-200k-telegram-bot/","credibility":2,"archive_timestamp":"2026-07-26T04:40:48+00:00"},{"url":"https://docs.sigma.win/","name":"Welcome to Sigma! — docs.sigma.win","type":"official","archive_url":"http://web.archive.org/web/20260313051216/https://docs.sigma.win/","credibility":2,"archive_timestamp":"2026-03-13T05:12:16+00:00"},{"url":"https://docs.sigma.win/other-info/key-features","name":"Key Features — Sigma User Guide","type":"official","archive_url":"http://web.archive.org/web/20260218030738/https://docs.sigma.win/other-info/key-features","credibility":2,"archive_timestamp":"2026-02-18T03:07:38+00:00"},{"url":"https://sigma.win/","name":"Sigma DeFi Platform — sigma.win","type":"official","archive_url":"http://web.archive.org/web/20260716232422/https://sigma.win/","credibility":2,"archive_timestamp":"2026-07-16T23:24:22+00:00"},{"url":"https://coincodecap.com/sigma-bot-review","name":"Sigma Bot Review (May 2026) — CoinCodeCap","type":"research","archive_url":"http://web.archive.org/web/20260213160636/https://coincodecap.com/sigma-bot-review","credibility":2,"archive_timestamp":"2026-02-13T16:06:36+00:00"},{"url":"https://defipill.xyz/telegram-trading-bots/sigma_review/","name":"Sigma Review (2026) — DeFiPill","type":"research","archive_url":"http://web.archive.org/web/20260208042028/https://defipill.xyz/telegram-trading-bots/sigma_review/","credibility":3,"archive_timestamp":"2026-02-08T04:20:28+00:00"},{"url":"https://dappradar.com/dapp/sigma-trading-bot","name":"Sigma Trading Bot — DappRadar","type":"research","archive_url":"https://web.archive.org/web/20260726221709/https://dappradar.com/dapp/sigma-trading-bot","credibility":2,"archive_timestamp":"2026-07-26T22:17:09+00:00"},{"url":"https://hacken.io/discover/telegram-crypto-trading-bots-risks/","name":"Telegram Crypto Trading Bots: Convenience vs. Security Risks — Hacken","type":"research","archive_url":"http://web.archive.org/web/20260420184116/https://hacken.io/discover/telegram-crypto-trading-bots-risks/","credibility":2,"archive_timestamp":"2026-04-20T18:41:16+00:00"},{"url":"https://www.bitget.com/academy/telegram-crypto-bots-8","name":"Telegram Crypto Trading Bots: Security Risks & Safety Guide 2026 — Bitget","type":"research","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.dextools.io/tutorials/telegram-trading-bots-2026-guide","name":"Telegram Trading Bots 2026 Guide — DEXTools","type":"research","archive_url":"https://web.archive.org/web/20260725211914/https://www.dextools.io/tutorials/telegram-trading-bots-2026-guide","credibility":2,"archive_timestamp":"2026-07-25T21:19:14+00:00"},{"url":"https://thedefiant.io/news/defi/hacker-ransacks-usd600-000-from-popular-telegram-trading-bot-unibot","name":"Hacker Ransacks $600,000 From Unibot — The Defiant","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/banana-gun-crypto-bot-refunds-3m","name":"Telegram bot Banana Gun to absorb $3M loss from hack — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260216144523/https://cointelegraph.com/news/banana-gun-crypto-bot-refunds-3m","credibility":1,"archive_timestamp":"2026-02-16T14:45:23+00:00"},{"url":"https://www.kucoin.com/news/flash/telegram-trading-bot-polycule-on-polymarket-hacked-230k-stolen","name":"Telegram Trading Bot Polycule on Polymarket Hacked, $230K Stolen — KuCoin","type":"news_article","archive_url":"http://web.archive.org/web/20260603190432/https://www.kucoin.com/news/flash/telegram-trading-bot-polycule-on-polymarket-hacked-230k-stolen","credibility":2,"archive_timestamp":"2026-06-03T19:04:32+00:00"},{"url":"https://basetradingbots.com/sigma-how-to-use/","name":"Sigma | How to use Sigma's trading bot for Base — BaseTrading Bots","type":"other","archive_url":"https://web.archive.org/web/20260725195618/https://basetradingbots.com/sigma-how-to-use/","credibility":3,"archive_timestamp":"2026-07-25T19:56:18+00:00"}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-31T07:24:48.157545+00:00","updated_at":"2026-07-27T16:51:31.22907+00:00"}}