Telegram Trading Bot Banana Gun to Refund $3 Million to Exploit Victims

Telegram-based trading bot Banana Gun was exploited last week. During the early Asian hours on Wednesday, the team announced that all victims will be made whole.  

Details

• Banana Gun helps users to execute on-chain transactions and snipe upcoming token launches
• The exploit came to light when some users saw "unauthorized transfers" take place from their wallets
• 'Known' people from the industry were targeted by the attacker who manually sent ETH from their wallets while they were interacting with the bot
• A potential vulnerability in the Telegram message oracle used was targeted by the exploiter

• The team has identified and patched the issue
• The back end has been re-deployed and Banana Gun has switched to new servers

Why should you pay attention?

• Banana Gun generated more than $6.3 billion worth of trading volume and boasts of a user base of 279,000 people
• The attacker targeted only “smart money” traders and crypto stalwarts — with an impactful social presence and trading expertise — who were not easy to scam
• With the rise in the number of DeFi scams, it is essential to take notes and beware

Who said what?

• The team assured users on X,

“A total of 11 users were affected, with $3M drained. All impacted users will be fully refunded from the Banana Gun treasury, with no tokens being sold for reimbursements"

Zooming out

• After the bot was shut down, no attacks have occured
• Banana Gun’s EVM and Solana bots are back online with no restrictions, except for a 2-hour transfer delay
• The team has also implemented enhanced security measures
• Two-factor authentication for transfers, however, is yet to be rolled out
• The team is in the midst of pen-testing and conducting additional audits for web-apps and Telegram bots