HostNexFlow › Library › BONKbot vs Trojan
BONKbot vs Trojan: the incumbent that dodged a bullet and the fork that won a divorce
Solana's two defining Telegram trading bots both carry famous incident files — BONKbot's Mar-2024 drainer scare (it wasn't the leak) and Trojan's birth (the Unibot divorce). Neither story is what the headline said, which is exactly why this page exists.
This pair is the Telegram-bot category's best two case studies — not because either was hacked, but because each's famous incident turned out to be about something else: a supply-chain-of-keys lesson for BONKbot, a governance divorce for Trojan. Understanding both files teaches the actual risk model of the category better than any marketing page.
Every row below names its source and date.
The parameter table
| Parameter | BONKbot | Trojan |
|---|---|---|
| Origin | Dec-2023 — built by the BONK memecoin team; the community-native incumbent when Solana's bot season opened. | Jan-4-2024 — launched as “Unibot on Solana” by the Unibot advisory team (Primordium/Reethmos), then rebranded to Trojan after the Mar-2024 divorce from the mainnet Unibot team. |
| Lineage drama | BONK-brand adjacency was the launch advantage — the coin's community onboarded the bot. | The divorce was public and ugly: Unibot accused the Solana team of launching an unauthorized EVM bot, refusing KYC, and skipping revenue commitments; the Solana team accused Unibot of attempted extortion — UNIBOT halved on the news (~$76→$33). |
| The March-2024 file | 302 wallets drained of ~2,808 SOL (~$523K) Mar-29 — BONKbot proved in-thread that every affected account had previously exported its private key; the actual leak was Solareum, which shut down (later research: ~$1.1M, 1,334+ victims, ~$942K frozen). | Not the leak — Trojan was unaffected by the Solareum compromise. Its risk file is the category's: platform-generated keys held for session trading. |
| Features | Buy/sell, referrals, BONK-ecosystem tie-ins; deliberately simple — the community bot. | The pro surface: limit orders, DCA, sniper automation, copy trading, MEV-protected private transactions, fail-guard sells, web Terminal + OEX perps layer. |
| Token | No bot token — BONK is the brand, not a revenue-share instrument for the bot. | TROJAN — revenue-share token born of the divorce; UNIBOT/TROJAN split accrued to TROJAN after ETH block 19410963. |
| Routing | Jupiter-routed Solana swaps — the router under the chat UI. | Solana-native routing across DEX liquidity; the same composable backend. |
| Key custody | Platform-generated wallet per user; keys exportable — which is precisely what made BONKbot users vulnerable elsewhere. | Same held-key shape — generated session wallets; exports carry the same downstream risk. |
The drainer that wasn't BONKbot
Mar-29-2024 is the best-documented near-miss in bot history. Wallets across Solana began draining — ~2,808 SOL (~$523K) from 302 identified victims — and the community's first suspect was the biggest bot, BONKbot. BONKbot's response is a model incident file: within hours it published its logs-based analysis showing 113 of its users were hit — and every one had previously exported their private key out of the bot. Users who never exported: untouched.
The actual culprit was Solareum, a different Telegram bot, whose compromise drained keys users had imported into it — including keys originally generated by BONKbot. Solareum shut down within days; follow-on research put the total closer to $1.1M across 1,334+ victims, with ~$942K frozen in Tether. The lesson is the page's real payload: in the held-key category, your key's weakest point is wherever you pasted it last, not where it was born.
The divorce that made Trojan
Trojan's origin is equally documented: the advisors who built Unibot's Solana deployment (Jan-4-2024) were cut loose in March amid public accusations both directions — Unibot citing unauthorized bots and missed commitments, the Solana team accusing Unibot of extortion. UNIBOT the token halved; the Solana product rebranded to Trojan and kept the users, the routing, and eventually the revenue-share design, accruing to a fresh TROJAN token.
It's a governance file, not a security one — nothing was stolen. But it documented the category's real fragility: a “team” split can orphan a product holding user session keys overnight, and the terms of your bot's custody are whatever the surviving entity says they are.
The shared risk model
Both bots generate the wallet you trade from inside their platform. That's the design premise — instant onboarding, Telegram-speed trading — and the permanent caveat: the service, its infrastructure, and anyone who obtains your exported key can move those funds. Neither bot's incident file shows a key leak from its own infrastructure, but the Solareum drain proved the ecosystem-level failure mode precisely: an exported key is a leaked key waiting for a weaker vessel.
The category rule stands regardless of which bot you pick: fund a bot wallet with a session's working capital, never a vault balance; sweep profits to real self-custody; and treat every export as permanent exposure.
Why Solana bots grew so differently from Ethereum bots
The pair's shape is itself a Solana artifact. On Ethereum, the bot category (Unibot, Maestro, Banana Gun) grew around MEV sniping on public mempools — the premium features were sandwich-resistance and bundle speed. On Solana there is no public mempool to snipe, so the bots converged on a different premium: Jupiter-grade routing speed, pump.fun launch sniping, wallet tracking, and copy-trading — surveillance features rather than ordering games. Trojan's whole feature spine (limit orders, DCA, sniper, copy, MEV-protected sends) is that Solana-shaped set.
BONKbot's divergence is branding-level rather than technical: it was born inside the BONK memecoin community, which meant its growth was a community phenomenon — a coin's holders onboarding into a trading tool made by the same team. That is why its user count dwarfed rivals early: it wasn't selling a product to traders so much as handing a community its first trading surface. The risk math is identical underneath; the trust felt at signup is not.
The honest frame for the whole category: Telegram bots are the one venue type where custody, execution, and social discovery collapse into a single chat window — which is exactly why the category's worst incidents (Solareum, and the countless key-extraction phish bots) live at the seams between those functions. BONKbot and Trojan are the two that emerged from the 2024 shakeout with their custody claims intact.
Who should pick which
Pick BONKbot if you want the community-standard simple surface — the meme-native incumbent with the cleanest post-incident record and the least feature surface to misconfigure. Pick Trojan if you want the pro toolset — limit orders, DCA, sniper/copy, MEV-protected sends — and you're comfortable backing the team that survived a public divorce intact. On either: the held-key caveat from the is-*-safe files applies identically — your bot wallet is a hot wallet with a chat interface.
Frequently asked
Was BONKbot hacked in March 2024?
No — the $523K drainer wave hit 302 wallets, and BONKbot proved every affected account had exported its key elsewhere. The compromised app was Solareum, a different bot, which shut down. BONKbot users who never exported keys were unaffected.
Is Trojan the same as Unibot?
It began as “Unibot on Solana” (Jan-4-2024) built by Unibot's advisory team; after the Mar-2024 public split, it rebranded to Trojan with its own TROJAN revenue-share token. Shared ancestry, separate company.
Do these bots hold my private keys?
Yes — both generate wallets on their infrastructure. That's the held-key model: trade with session capital only, sweep profits to self-custody, and treat every key export as permanent exposure.
What happened to the stolen SOL?
The Solareum drain moved ~$523K initially identified (later tallied ~$1.1M, 1,334+ victims); ~$942K was frozen in Tether per post-incident research. Solareum closed; affected users were largely unrecovered.
Which bot is cheaper?
Both charge ~1%-class per-trade fees plus referral rebates; compare the live fee panel inside each bot — the published rates shift with competition.
Can I use both on one wallet?
Each generates its own wallet; a key exported from one and imported into the other is exactly the pattern the March-2024 drain exploited — keep keys siloed.