Floki Takes Telegram Trading Bot Offline to Investigate Exploit, Plans New Wallets for Affected Users

Floki has taken its trading bot offline while it investigates an exploit, according to The Defiant. The team is working to protect remaining user funds and to confirm which users of the @flokitradingbot were affected. Those users will be moved to new, secure wallets, and any remaining funds will be sent to them.

What Users Have Been Told to Do

Until further notice, nobody should deposit into a bot wallet. Users who exported a private key and still hold funds in that wallet should move them to a wallet only they control. Phemex reported that the project's warning applies to users who exported their keys, and urged them to move assets to wallets under their sole control to prevent further losses.

The $FLOKI team also said it will never send a direct message first or ask for a seed phrase. Users should ignore anyone offering "refunds" or asset recovery services. TechFlow, citing The Defiant, likewise reported that the team cautioned users to be wary of people proactively contacting them with such offers.

Phemex noted that no details on the scale of the exploit or the number of affected accounts have been disclosed. It is also not yet clear how the exploit occurred or how much was taken.

About the Floki Trading Bot

According to the project's documentation, the Floki Trading Bot is a tool within the Floki ecosystem that lets users trade cryptocurrencies from Telegram. The documentation states that a 1% fee applies to each trade, with 50% of those fees allocated to buying and burning $FLOKI. It also cites more than $100 million in trading volume and over 50,000 users, though those figures come from an earlier version of the page and may be out of date.

The bot's terms describe it as a multi-chain Telegram bot with hot wallet creation and management. Hot wallets are connected to the internet, which is why users are advised to keep only the funds they need for trading in them.

Telegram-based trading bots have been targeted before. In the Unibot incident, an attacker used a vulnerability in the bot's smart contract to take over $600,000 from users' wallets, according to Coin360.

Floki has dealt with a security issue before. In February 2022, the Floki Inu team disabled its cross-chain bridge after discovering an exploit, Benzinga reported, saying it acted before bad actors could take advantage.

Users of the bot should wait for official updates from the Floki team and avoid acting on unsolicited messages.