{
 "tag": "telegram-bot",
 "name": "Telegram Bot",
 "group": "Other",
 "incidents": [
  {
   "slug": "sigma-telegram-bot-wallets-key-leak-200k-may-2026",
   "title": "Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak",
   "url": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026",
   "json": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "base",
    "bsc"
   ],
   "method": "key-leak",
   "product": "SIGMA Telegram trading bot wallets (one trader)",
   "tags": [
    "ethereum",
    "base",
    "bsc",
    "key-leak",
    "sigma",
    "telegram-bot",
    "trading-bot",
    "private-key",
    "fake-captcha"
   ],
   "amountUsd": 200000,
   "victims": 1,
   "startedAt": "2026-05-11",
   "closedAt": "2026-05-11",
   "updatedAt": "2026-05-11T12:00:00Z",
   "summary": "On 11 May 2026 a crypto trader lost over $200,000 across Ethereum, Base and BSC from two wallets created by the SIGMA Telegram trading bot; the largest losses were about $125,000 in POD on Base and $21,000 in FHE on BSC. An on-chain analyst said the drain used the private keys directly, with no token approval involved, while the victim's other wallets were untouched. The cause is unconfirmed; suggestions include fake CAPTCHA bots in Telegram, infostealer malware or a device compromise. Users of bot-generated wallets should keep balances small and never run 'verification' steps a Telegram bot asks for."
  },
  {
   "slug": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "title": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026",
   "json": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "polygon"
   ],
   "method": "key-leak",
   "product": "Polycule Telegram trading bot users (Polymarket, Polygon)",
   "tags": [
    "polygon",
    "key-leak",
    "polycule",
    "polymarket",
    "telegram-bot",
    "custodial-bot",
    "trading-bot"
   ],
   "amountUsd": 230000,
   "victims": null,
   "startedAt": "2026-01-13",
   "closedAt": "2026-01-14",
   "updatedAt": "2026-01-14T12:00:00Z",
   "summary": "Polycule, a Telegram bot for trading on Polymarket, confirmed on 13 Jan 2026 that it had been hacked and that about $230,000 of user funds held in bot-managed Polygon wallets was taken. The team took the bot offline and promised a patch and compensation; no official root cause was published, and some rivals called it a rug pull. Custodial Telegram bots keep users' private keys on their own servers, so one breach can drain every user at once. Keep only small trading balances in any bot wallet."
  }
 ],
 "changes": [
  {
   "incident": "sigma-telegram-bot-wallets-key-leak-200k-may-2026",
   "incidentTitle": "Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-05-11",
   "title": "A trader reported two SIGMA-generated wallets drained of over $200,000 on Ethereum, Base and BSC; analysts pointed to a private-key leak.",
   "sourceUrl": "https://www.cryptopolitan.com/crypto-trader-loses-200k-telegram-bot/",
   "url": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026"
  },
  {
   "incident": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "incidentTitle": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-14",
   "title": "Odaily published an ExVul Security analysis of the risks of custodial prediction-market bots.",
   "sourceUrl": "https://www.odaily.news/en/post/5208756",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026"
  },
  {
   "incident": "polycule-polymarket-telegram-bot-hack-jan-2026",
   "incidentTitle": "Polycule, a Telegram trading bot for Polymarket, hacked for about $230K of user funds",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-13",
   "title": "Polycule confirmed its Telegram trading bot was hacked, about $230,000 of user funds lost; the bot was taken offline.",
   "sourceUrl": "https://www.odaily.news/en/post/5208756",
   "url": "https://drains.watch/i/polycule-polymarket-telegram-bot-hack-jan-2026"
  }
 ]
}