Sep 2024 - Banana Gun Telegram Bot Wallets Drained - $3m (Global)
"TRADE CRYPTO THE BANANA WAY"
"Welcome to Banana Gun, YOUR trading bot. Available on Telegram and soon our own webapp. Snipe upcoming launches or safely trade tokens that are already live. We are your go-to platform for trading on the Ethereum, Solana, Base and Blast chains (with more to come!)."
"The best trading bot on Ethereum, Solana, Base and Blast. Built by on-chain traders."
"Initially reported as a $1.9M slipup affecting 36 users, this bunch of bad news eventually grew to a $3M whopper impacting 11 very unhappy campers."
"There is rumour that @BananaGunBot wallet's getting drained right now. Recipient of the 6 drained wallets i could find is 0xe451241389b80a980c44dd55805eb05276cd141c 0xd073f28400be60aae6691d6131b5f7f45e91d999 But there is rumour that there are much more victims."
"Seems like there is already 36 victims with almost 563 #ETH stolen "so far" on mainnet. The last one was drained an hour ago, but there is more rumour that drains started on #SOL too."
ZekeEther: "is @BananaGunBot hacked?
my wallet is out $15k, completely drained. trying to check onchain transaction but TG bot is also not working.
gosh, how much worse can one life fucking get!"
Mduz_NFT: "Did anyone else got drain for 50k from @BananaGunBot?
Please tell me I'm dreaming."
"@BananaGunBot has reportedly been exploited with wallet draining incidents. Users should temporarily move all funds to ensure that they are safe - sheesh!"
"Transfer all your funds from telegram trading bots. Already seen lots of drained wallet messages about @BananaGunBot. Do not use any tg trading bots for now."
"As one of the few victims, I individually lost 128e on the exploit while I was asleep. They targetted a few specific ppl, honestly one of the most bizarre hacks I've ever seen.
Thankfully, the Banana team is goated, and I'll be seeing my funds again soon. Will keep using"
"Today, some users of Banana Gun experienced unauthorized transfers from their wallets. Promptly after the first incident, we immediately switched off the bot and began diligently checking our back-end.
We have confirmed that our back-end is not compromised. Both the router and database have been thoroughly inspected, and only a very small number of users (fewer than 10) were affected. Additionally, the transfers appear to have been executed manually.
This leads us to believe the issue may stem from a front-end vulnerability.
As we prioritize security, we will keep our bot offline while we investigate the root cause. The amount of support we've received, particularly from our partners, has been truly heartwarming. If you have any insights that may help us, feel free to send us a direct message here on Twitter."
"First of all, we’re humbled by the incredible bot activity on Banana Gun, even after last week’s incident. Thank you all for your patience and trust. We take this as a testament that we're handling the situation properly. As previously mentioned, our EVM and Solana bots are back online with no restrictions, except for a 2-hour transfer delay.
A total of 11 users were affected, with $3M drained. All impacted users will be fully refunded from the Banana Gun treasury, with no tokens being sold for reimbursements."
Further Analysis
Banana Gun is a Telegram-based trading bot. On September 19th, 2024, multiple high-profile users started reporting their funds being drained from their wallets, live in front of them. While full details of the vulnerability have not yet been released, it is believed to be a vulnerability in the Telegram messaging system. 2FA on withdrawals, and a 2 hour delay, were both implemented in response. Users who were affected have reportedly all been reimbursed.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
DIN Twitter Account Breach Ransom Attempt > > < < Decentraland Official Twitter Account Compromise
Sources/Further Reading
Rekt - Banana Gun - Rekt (Dec 31)
@BananaGunBot Twitter (Dec 31)
@YannickCrypto Twitter (Dec 31)
@YannickCrypto Twitter (Dec 31)
@YannickCrypto Twitter (Dec 31)
@BananaGunBot Twitter (Dec 31)
@RektHQ Twitter (Dec 31)
@Sheesh_On_Eth Twitter (Dec 31)
@CryoFrosty Twitter (Dec 31)
@befreeshcrypto Twitter (Dec 31)
@ArbitrageScan Twitter (Dec 31)
Personal Account | Arbitrage Scanner (Dec 31)
@thesheikhcrypto Twitter (Dec 31)
@defi_ant_degen Twitter (Dec 31)
@TheCryptoChefX Twitter (Dec 31)
@SwiatKrypto Twitter (Dec 31)
@fud_and_cry Twitter (Dec 31)
@Solidstarforlyf Twitter (Dec 31)
@PetitPrinceETH Twitter (Dec 31)
@PastanagaCrypto Twitter (Dec 31)
@ZekeEther Twitter (Dec 31)
@Mduz_NFT Twitter (Dec 31)
@HRS_777 Twitter (Dec 31)
@Tawkcrypto Twitter (Dec 31)
@AltcoinsFrance Twitter (Dec 31)
@Web3France_fr Twitter (Dec 31)
@Charlie_Gems Twitter (Dec 31)
@pnldailyy Twitter (Dec 31)
@CryptoBullEye Twitter (Dec 31)
@EzMoneyGems Twitter (Dec 31)
@living_life_9 Twitter (Dec 31)
@cryptocevo Twitter (Dec 31)
@WawKasem Twitter (Dec 31)
@Gotham_New Twitter (Dec 31)
@Gotham_New Twitter (Dec 31)
@Gotham_New Twitter (Dec 31)
@Gotham_New Twitter (Dec 31)
@IBendCrypto Twitter (Dec 31)
@ManaMoonNFT Twitter (Dec 31)
@stacy_muur Twitter (Dec 31)
@Alaouicapital Twitter (Dec 31)
@MaestroBots Twitter (Dec 31)
@razvaneth Twitter (Dec 31)
@denisventures Twitter (Dec 31)
@Gotham_New Twitter (Dec 31)
@daze05xx Twitter (Dec 31)
@Talesofthechain Twitter (Dec 31)
@APederzoli Twitter (Dec 31)
@Gotham_New Twitter (Dec 31)
@MCMongX Twitter (Dec 31)
@HidalgoEric90 Twitter (Dec 31)
@BotfatherTG Twitter (Dec 31)
@MCMongX Twitter (Dec 31)
@beincrypto_es Twitter (Dec 31)
@Mamuduwill66845 Twitter (Dec 31)
@ForkLog Twitter (Dec 31)
@ABMedia_Crypto Twitter (Dec 31)
@LeButineur_Off Twitter (Dec 31)
@thepumpengine Twitter (Dec 31)
@6ft6ETH Twitter (Dec 31)
@0xdodonews Twitter (Dec 31)
@dippy_eth Twitter (Dec 31)
@KriptoAirdropTG Twitter (Dec 31)
@tritonsniperio Twitter (Dec 31)
@MCMongX Twitter (Dec 31)
@CapGemz Twitter (Dec 31)
@matty4188 Twitter (Dec 31)
@cybertech_pro01 Twitter (Dec 31)
@MrBeanCaller Twitter (Dec 31)
@mywebacy Twitter (Dec 31)
@ICODrops Twitter (Dec 31)
@protectmywallet Twitter (Dec 31)
@hackless_defi Twitter (Dec 31)
@CryptoGrayWolf Twitter (Dec 31)
@CryptopepperP Twitter (Dec 31)
@ProdigyTradeBot Twitter (Dec 31)
@boot2thrill Twitter (Dec 31)
@hodooi Twitter (Dec 31)
@Modern_Spider Twitter (Dec 31)
@ForkDAOes Twitter (Dec 31)
@jikan_talakawa Twitter (Dec 31)
@ZoOoOoOM89 Twitter (Dec 31)
@cryptonews Twitter (Dec 31)
@DefiantNews Twitter (Dec 31)
@young_Cryptoo Twitter (Dec 31)
@ChadCaff Twitter (Dec 31)
@respit_ Twitter (Dec 31)
@GL_Capital_ Twitter (Dec 31)
@0xImmortal_ Twitter (Dec 31)
@MCMongX Twitter (Dec 31)
@sicentsoicentsi Twitter (Dec 31)
@tritonsniperio Twitter (Dec 31)
@WenTV_io Twitter (Dec 31)
@BananaBananko24 Twitter (Dec 31)
@CashIsTrash_ Twitter (Dec 31)
@GL_Capital_ Twitter (Dec 31)
@metasolanabot Twitter (Dec 31)
@PablojSojo Twitter (Dec 31)
@TheJs7one Twitter (Dec 31)
@hellosuoha Twitter (Dec 31)
@spyflips Twitter (Dec 31)
@iCryptoGuardian Twitter (Dec 31)
@KriptoAirdropTG Twitter (Dec 31)
@OdailyChina Twitter (Dec 31)
@spyflips Twitter (Dec 31)
@pierarmy_eth Twitter (Dec 31)
@ghostdog3333 Twitter (Dec 31)
@CryptolandOffi1 Twitter (Dec 31)
@Crypto_D00M Twitter (Dec 31)
@BananaGunBot Twitter (Dec 31)
Trade Crypto the Banana Way | Banana Gun (Dec 31)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|