Verify a decision

{"actor":"system:backfill","investigation_id":"691f4a75-e5d0-4cc7-a668-7a3042eef2ba","kind":"publish","page_slug":"bonkbot","published_at":"2026-05-31T20:28:06.267Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"BonkBot","sections":[{"content":"BonkBot (stylized BONKbot) is a Telegram-based trading bot built on the Solana blockchain. It was originally developed by a creator operating under the pseudonym 'futurekarol' (Karol), who approached the BONK DAO team after independently building the product. Per a verified account from an Unlayered podcast interview, the BONK team and BonkBot remain legally separate entities despite sharing branding; the BONK community stumbled into association with the bot rather than directly commissioning it. The product routes trades through Jupiter Aggregator and Jito Labs infrastructure to offer fast execution and MEV protection within the Telegram interface. BonkBot's fee model directs 100% of its 1% per-trade fee toward purchasing BONK tokens from the open market, with a portion burned, making the fee mechanism deflationary for the BONK token supply.","heading":"Overview and Background","severity":"low","sources":[{"credibility":2,"name":"Solana Compass: Bonkbot Memecoin Trading on Telegram with Karol","type":"other","url":"https://solanacompass.com/learn/Unlayered/bonkbot-memecoin-trading-on-telegram-with-karol"},{"credibility":3,"name":"sal.hl on X: BonkBot and BONK team are separate entities","type":"social_media","url":"https://x.com/salxyz/status/1771291513386914231"},{"credibility":1,"name":"BONKbot official website","type":"official","url":"https://bonkbot.io/"}]},{"content":"For most of its operational history, BonkBot functioned under a custodial architecture in which the platform held or managed user private keys server-side. This is a category-wide risk for Telegram trading bots: users must deposit funds into a wallet whose keys are generated and stored by the bot operator, creating a counterparty risk if the operator's infrastructure is breached or acts maliciously. BonkBot's documentation explicitly warns that scammers impersonate the bot in Telegram and that users should never share private keys with anyone.\n\nOn October 9, 2024, BonkBot announced a transition to a non-custodial architecture via a custom in-house Key Management System (KMS). The KMS employs dedicated servers with AMD processors and Trusted Platform Modules (TPM) version 2, with only BonkBot-signed images permitted to boot. RAM encryption is enabled, and the system is described by the team as akin to a 'cloud hardware wallet' where keys are encrypted such that only the user can authorize transactions. Two-factor authentication (2FA), including passkey and Face ID support, was added to protect accounts even if an associated Telegram account is compromised. The rollout was planned in three phases across the 416,000+ user base at the time of announcement.\n\nIndependent security verification of the KMS architecture by a third-party auditor has not been publicly confirmed as of the research date. The team's claims about TPM-backed key isolation and remote attestation are technically plausible but have not been independently audited in any publicly available report.","heading":"Custody and Private Key Security Model","severity":"high","sources":[{"credibility":2,"name":"Cryptopolitan: Bonkbot is going non-custodial with increased security measures","type":"news_article","url":"https://www.cryptopolitan.com/bonkbot-is-going-non-custodial-with-increased-security-measures/"},{"credibility":2,"name":"Bitget News: Bonkbot is going non custodial with increased security measures","type":"news_article","url":"https://www.bitget.com/news/detail/12560604259487"},{"credibility":1,"name":"BONKbot Docs: Wallet Security / 2FA","type":"official","url":"https://docs.bonkbot.io/features/wallet-security-2fa"},{"credibility":1,"name":"FAQ: BONKbot Next-Generation Key Management System","type":"official","url":"https://bonkbot.world/blog/faq-bonkbots-next-generation-key-management-system.html"},{"credibility":2,"name":"Solana Floor: Crypto's Biggest Telegram-Based Trading Tool Just Got a Major Upgrade","type":"news_article","url":"https://solanafloor.com/news/cryptos-biggest-telegram-based-trading-tool-major-upgrade"}]},{"content":"In late March 2024, approximately 302 users lost a combined 2,808 SOL (worth roughly $523,000 at prevailing prices) in a coordinated wallet drain event. Cybersecurity firm CertiK initially flagged the incident as a possible private key leak affecting BonkBot users, estimating initial losses of at least $208,000. The largest single loss attributed to one victim was approximately 500 SOL (~$93,000).\n\nBonkBot issued public statements on X (formerly Twitter) asserting that its own infrastructure was not compromised and that every affected user account had previously exported their private keys from BonkBot into a third-party application. The team pointed to Solareum, a rival Telegram trading bot, as the point of compromise: their logs showed a strong correlation between victims and users who had imported their exported BonkBot keys into Solareum. Of the 302 total victims, BonkBot stated 113 were former BonkBot users; the remainder were users of other services.\n\nSolareum subsequently announced a shutdown, citing 'insufficient funds, evolving market trends, and the recent security breach' as contributing factors. Solareum made no public commitment to compensate affected users. Some affected users disputed BonkBot's claim that they had exported private keys, though these counter-claims appeared only in social media posts (Tier 3 sources) and could not be independently verified.\n\nDogecoin developer Mishaboar issued a public warning around the same period cautioning all users of custodial Telegram trading bots, including BonkBot, to withdraw funds until security assurances could be independently verified. This warning predated or was concurrent with BonkBot's later non-custodial migration announcement.","heading":"March 2024 Wallet Drain Incident","severity":"critical","sources":[{"credibility":2,"name":"Decrypt: Solana Wallets Drained of $523K, BONKbot Denies Link","type":"news_article","url":"https://decrypt.co/224127/solana-wallets-drained-523k-bonkbot-denies-link"},{"credibility":2,"name":"CoinPaper: Some of BONKbot's users were affected by a private key leak","type":"news_article","url":"https://coinpaper.com/3786/bon-kbot-claims-to-be-unaffected-by-solana-wallet-exploit-but-users-claim-otherwise"},{"credibility":2,"name":"Yahoo Finance: Solareum Telegram Trading App Shuts Down Following $523K Exploit","type":"news_article","url":"https://finance.yahoo.com/news/solareum-telegram-trading-app-shuts-051855343.html"},{"credibility":3,"name":"BONKbot on X: TLDR BONKbot is SAFE — Solareum implicated","type":"social_media","url":"https://x.com/bonkbot_io/status/1773769443845574764"},{"credibility":2,"name":"Binance Square: BONKbot Addresses Security Concerns","type":"news_article","url":"https://www.binance.com/en/square/post/2024-03-29-solana-s-bonkbot-addresses-security-concerns-and-vulnerabilities-6050121480601"},{"credibility":2,"name":"CoinGape: Dogecoin Developer Signals Alert Over BonkBot Trading Flaws","type":"news_article","url":"https://coingape.com/dogecoin-developer-signals-alert-over-bonkbot-trading-flaws/"},{"credibility":2,"name":"CryptoNews.net: Solana Telegram Trading Bot to Shut Down After Users Drained of $523K","type":"news_article","url":"https://cryptonews.net/news/security/28803619/"}]},{"content":"BonkBot's official documentation explicitly acknowledges a persistent ecosystem of fake bots and impersonator accounts on Telegram designed to mimic the legitimate service. These fraudulent bots ask users to deposit SOL and then drain deposited funds. The official documentation states that legitimate BonkBot administrators will never direct-message users first, and will never request a private key or seed phrase. The genuine bot is accessible at t.me/bonkbot_bot.\n\nCirculation of fake BonkBot referral links — which redirect to wallet drainers rather than the legitimate bot — has been noted in the community. The high brand recognition of BonkBot within the Solana trading community makes it an attractive target for impersonation. Users who have not verified the bot username against the official documentation are at elevated risk.","heading":"Impersonation and Fake Bot Ecosystem","severity":"high","sources":[{"credibility":1,"name":"BONKbot Docs: Avoiding Scams","type":"official","url":"https://docs.bonkbot.io/safety-and-security/avoiding-scams"}]},{"content":"BonkBot charges a flat 1% fee on each successful swap transaction. There is no charge for account setup or holding funds in the associated wallet. The platform reports directing 100% of collected fees toward purchasing BONK tokens from the open market, with 20% of purchased tokens immediately burned, creating a deflationary pressure on the BONK token supply.\n\nAccording to DeFiLlama data, BonkBot has generated cumulative protocol fees exceeding $93 million since inception, with annualized fees running at approximately $6.33 million. In January 2024, the bot generated $10.3 million in a single month. A single-day fee record of $1.23 million was set on January 31, 2024, coinciding with the Jupiter (JUP) token airdrop and associated trading surge. As of mid-2025, the platform reports $4.35 million in monthly fees and $14.1 billion in lifetime trading volume.\n\nA tiered referral program offers a 30% revenue share in the first month, 20% in the second month, and 10% on a lifetime basis for direct referrals, extending to further revenue share tiers for second- and third-level referrals. Active traders can also earn up to 25% cashback on fees through a volume-based rewards program.\n\nThe 1% fee is materially higher than some competing bots and traditional DEX aggregators. Users should weigh this cost against convenience features when evaluating the platform.","heading":"Fee Structure and Revenue","severity":"low","sources":[{"credibility":2,"name":"DeFiLlama: BONKbot Fees, Revenue and Income Statement","type":"on_chain","url":"https://defillama.com/protocol/bonkbot"},{"credibility":1,"name":"BONKbot Docs: Fee Structure","type":"official","url":"https://docs.bonkbot.io/fee-structure"},{"credibility":1,"name":"BONKbot Docs: Referrals","type":"official","url":"https://docs.bonkbot.io/rewards/referrals"},{"credibility":2,"name":"Solana Floor: BONKbot generated $10 million in fees in December","type":"news_article","url":"https://solanafloor.com/news/bon-kbot-generated-10-million-in-fees-in-december-with-the-total-traded-volume-crossing-1-billion"},{"credibility":2,"name":"Solana Floor: BonkBot Shatters Records with $1.23M Daily Fees during JUP Launch","type":"news_article","url":"https://solanafloor.com/news/bonk-bot-shatters-records-with-1-23-m-in-daily-fees-during-jup-launch-on-solana"},{"credibility":2,"name":"Crypto.news: Telegram bot BonkBot tops $250m in daily trading volume","type":"news_article","url":"https://crypto.news/telegram-bot-bonkbot-tops-250m-in-daily-trading-volume/"}]},{"content":"BonkBot was built by a developer known publicly as 'Karol' (X handle: @futurekarol), who operates as co-founder and lead developer. A co-founder known as 'King Dot Sol' handles partnerships and community growth. Both individuals use pseudonymous or abbreviated identities in public-facing communications; full legal names have not been publicly disclosed. The team has expanded from two to approximately five members.\n\nBonkBot's terms of service state that the platform operates out of Switzerland. The company claims to be a 'mere software provider' and is not registered with any financial regulatory authority. No formal corporate entity name has been publicized in major press coverage reviewed during this investigation.\n\nBonkBot and BONK DAO are legally separate entities. The BONK DAO has its own identified community founder ('Nom,' a pseudonymous long-time Solana developer) but has no operational control over the BonkBot product. The shared branding creates potential confusion about accountability: users disputing fund losses may find it unclear which entity, if any, bears legal responsibility.\n\nNo SEC, CFTC, DOJ, or equivalent regulatory action against BonkBot or its operators was identified during this investigation.","heading":"Team Transparency and Corporate Structure","severity":"medium","sources":[{"credibility":2,"name":"Solana Compass: Bonkbot Memecoin Trading on Telegram with Karol (Unlayered podcast)","type":"other","url":"https://solanacompass.com/learn/Unlayered/bonkbot-memecoin-trading-on-telegram-with-karol"},{"credibility":3,"name":"sal.hl on X: BonkBot creator is futurekarol; separate from BONK team","type":"social_media","url":"https://x.com/salxyz/status/1771291513386914231"},{"credibility":1,"name":"BONKbot Terms of Service","type":"official","url":"https://bonkbot.io/legal/terms-of-service"},{"credibility":2,"name":"Solana Compass: Bonk Founder Nom on Revitalizing Solana","type":"other","url":"https://solanacompass.com/learn/Midcurve/bringing-solana-back-from-the-dead-with-bonk-founder-nom"}]},{"content":"BonkBot's terms of service explicitly disclaim financial regulatory registration in any jurisdiction and characterize the product as software infrastructure rather than a financial service. The platform does not impose KYC or AML checks on users, consistent with the broader class of non-custodial DeFi tooling. However, this characterization may not be determinative under evolving regulatory frameworks: to the extent BonkBot facilitates transactions and charges fees, regulators in certain jurisdictions may classify it as a money services business or virtual asset service provider.\n\nNo specific regulatory inquiry, warning notice, or enforcement action targeting BonkBot was identified in public records reviewed for this investigation. The absence of enforcement does not constitute regulatory clearance, particularly given ongoing global regulatory activity around Telegram-based crypto services.","heading":"Regulatory and Compliance Considerations","severity":"medium","sources":[{"credibility":1,"name":"BONKbot Terms of Service","type":"official","url":"https://bonkbot.io/legal/terms-of-service"}]},{"content":"BonkBot is one of the most prominent Solana Telegram trading bots by volume and user count, reporting over $14.1 billion in lifetime trades and 526,000 total users as of 2025. It ranks second among Telegram trading bots by volume, behind Trojan. CoinGecko and Solana Compass have included it in top-five Solana Telegram bot rankings. The platform routes orders through Jupiter Aggregator and benefits from Jito Labs MEV protection, aligning it with established Solana DeFi infrastructure. MoonPay integration provides a fiat on-ramp. These integrations with audited infrastructure providers reduce (but do not eliminate) certain execution-layer risks.","heading":"Market Position and Competitive Context","severity":"low","sources":[{"credibility":2,"name":"CoinGecko: Top 5 Solana Telegram Trading Bots","type":"research","url":"https://www.coingecko.com/learn/solana-telegram-trading-bots"},{"credibility":2,"name":"Solana Compass: BONKbot Project Overview","type":"research","url":"https://solanacompass.com/projects/bonkbot"},{"credibility":3,"name":"Bitget Academy: BonkBot Guide 2026","type":"other","url":"https://www.bitget.com/academy/bonkbot-cryptocurrency-trading-bot-guide-2026-complete-solana-defi-trading-for-america"}]}],"sources_used":[{"credibility":1,"name":"BONKbot Official Website","type":"official","url":"https://bonkbot.io/"},{"credibility":1,"name":"BONKbot Docs: Overview","type":"official","url":"https://docs.bonkbot.io/"},{"credibility":1,"name":"BONKbot Docs: Avoiding Scams","type":"official","url":"https://docs.bonkbot.io/safety-and-security/avoiding-scams"},{"credibility":1,"name":"BONKbot Docs: Fee Structure","type":"official","url":"https://docs.bonkbot.io/fee-structure"},{"credibility":1,"name":"BONKbot Docs: Referrals","type":"official","url":"https://docs.bonkbot.io/rewards/referrals"},{"credibility":1,"name":"BONKbot Terms of Service","type":"official","url":"https://bonkbot.io/legal/terms-of-service"},{"credibility":2,"name":"Decrypt: Solana Wallets Drained of $523K, BONKbot Denies Link","type":"news_article","url":"https://decrypt.co/224127/solana-wallets-drained-523k-bonkbot-denies-link"},{"credibility":2,"name":"Yahoo Finance: Solareum Shuts Down Following $523K Exploit","type":"news_article","url":"https://finance.yahoo.com/news/solareum-telegram-trading-app-shuts-051855343.html"},{"credibility":2,"name":"CoinPaper: BONKbot Users Affected by Private Key Leak","type":"news_article","url":"https://coinpaper.com/3786/bon-kbot-claims-to-be-unaffected-by-solana-wallet-exploit-but-users-claim-otherwise"},{"credibility":2,"name":"CoinGape: Dogecoin Developer Signals Alert Over BonkBot Trading Flaws","type":"news_article","url":"https://coingape.com/dogecoin-developer-signals-alert-over-bonkbot-trading-flaws/"},{"credibility":2,"name":"Cryptopolitan: Bonkbot Going Non-Custodial","type":"news_article","url":"https://www.cryptopolitan.com/bonkbot-is-going-non-custodial-with-increased-security-measures/"},{"credibility":2,"name":"Solana Floor: BonkBot $1.23M Daily Fees During JUP Launch","type":"news_article","url":"https://solanafloor.com/news/bonk-bot-shatters-records-with-1-23-m-in-daily-fees-during-jup-launch-on-solana"},{"credibility":2,"name":"Solana Floor: BONKbot $10M Fees December 2023","type":"news_article","url":"https://solanafloor.com/news/bon-kbot-generated-10-million-in-fees-in-december-with-the-total-traded-volume-crossing-1-billion"},{"credibility":2,"name":"DeFiLlama: BONKbot Protocol Fees","type":"on_chain","url":"https://defillama.com/protocol/bonkbot"},{"credibility":2,"name":"Solana Compass: BONKbot Project Review","type":"research","url":"https://solanacompass.com/projects/bonkbot"},{"credibility":2,"name":"Solana Compass: Bonkbot Memecoin Trading on Telegram with Karol","type":"other","url":"https://solanacompass.com/learn/Unlayered/bonkbot-memecoin-trading-on-telegram-with-karol"},{"credibility":2,"name":"CoinGecko: Top 5 Solana Telegram Trading Bots","type":"research","url":"https://www.coingecko.com/learn/solana-telegram-trading-bots"},{"credibility":2,"name":"Binance Square: BONKbot Addresses Security Concerns","type":"news_article","url":"https://www.binance.com/en/square/post/2024-03-29-solana-s-bonkbot-addresses-security-concerns-and-vulnerabilities-6050121480601"},{"credibility":3,"name":"BONKbot on X: Solareum as point of compromise","type":"social_media","url":"https://x.com/bonkbot_io/status/1773769443845574764"},{"credibility":1,"name":"FAQ: BONKbot Next-Generation Key Management System","type":"official","url":"https://bonkbot.world/blog/faq-bonkbots-next-generation-key-management-system.html"},{"credibility":2,"name":"CoinGape: BonkBot Non-Custodial Announcement","type":"news_article","url":"https://coingape.com/solanas-bonkbot-announces-game-changing-technology-to-promote-self-custody/"},{"credibility":2,"name":"Crypto.news: BonkBot tops $250M in daily trading volume","type":"news_article","url":"https://crypto.news/telegram-bot-bonkbot-tops-250m-in-daily-trading-volume/"}],"summary":"BonkBot is a Solana-focused Telegram trading bot launched in 2023, affiliated with the BONK memecoin community but operated as a legally separate entity. It has grown to become one of the largest Telegram-based trading bots by volume, reporting over $14 billion in lifetime trades and more than 500,000 total users, with all 1% trading fees directed toward purchasing and burning BONK tokens. The platform operated in a custodial manner for most of its history before announcing a non-custodial key management system upgrade in October 2024; a March 2024 incident in which 302 users lost approximately $523,000 in SOL highlighted custody risks common to this class of product, though BonkBot attributed the losses to a compromise at a rival bot (Solareum) rather than its own infrastructure.","timeline":[{"date":"2023-08-01","event":"BonkBot launched on Telegram by developer Karol as a simple Jupiter wrapper for trading on Solana; initial usage was modest, supported primarily by the BONK community.","source":"Solana Compass / Unlayered podcast","source_url":"https://solanacompass.com/learn/Unlayered/bonkbot-memecoin-trading-on-telegram-with-karol"},{"date":"2023-11-01","event":"Post-Solana Breakpoint conference and onset of airdrop season, trading volume on BonkBot surged substantially as demand for Solana memecoin trading grew.","source":"Solana Compass / Unlayered podcast","source_url":"https://solanacompass.com/learn/Unlayered/bonkbot-memecoin-trading-on-telegram-with-karol"},{"date":"2024-01-31","event":"BonkBot recorded a single-day fee record of $1.23 million coinciding with the Jupiter (JUP) token airdrop, and generated $10.3 million in fees for January 2024.","source":"Solana Floor","source_url":"https://solanafloor.com/news/bonk-bot-shatters-records-with-1-23-m-in-daily-fees-during-jup-launch-on-solana"},{"date":"2024-03-29","event":"CertiK flagged a possible exploit affecting BonkBot users; approximately 302 victims ultimately lost 2,808 SOL (~$523,000). BonkBot attributed the compromise to Solareum, a rival Telegram trading bot, whose users had imported BonkBot-exported private keys.","source":"Decrypt / Yahoo Finance","source_url":"https://decrypt.co/224127/solana-wallets-drained-523k-bonkbot-denies-link"},{"date":"2024-03-29","event":"Dogecoin developer Mishaboar issued a public warning advising users of all custodial Telegram crypto bots, including BonkBot, to withdraw funds pending security clarification.","source":"CoinGape","source_url":"https://coingape.com/dogecoin-developer-signals-alert-over-bonkbot-trading-flaws/"},{"date":"2024-03-30","event":"Solareum announced it would shut down operations, citing the security breach, insufficient funds, and changing market conditions. No user compensation was announced.","source":"Yahoo Finance","source_url":"https://finance.yahoo.com/news/solareum-telegram-trading-app-shuts-051855343.html"},{"date":"2024-10-09","event":"BonkBot announced a transition to a non-custodial architecture via a custom Key Management System (KMS) using AMD TPM 2.0 hardware, with a phased rollout to 416,000+ users. Two-factor authentication and passkey support were added.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/bonkbot-is-going-non-custodial-with-increased-security-measures/"}]},"v":1}