Skip to main content
Category: Frauds → Giveaway & Airdrop FraudsFraudsGiveaway & Airdrop FraudsMalicious BotsReading time: 10 minutes
Risk level: Critical
Target audience: Telegram users, Discord members, airdrop hunters

​
Meet Oyekunle

Oyekunle is a 29-year-old developer who actively participates in Telegram crypto communities. He’s part of several airdrop hunting groups where bots automatically alert members of new airdrops. One day, in a Telegram group focused on Polygon airdrops, a new bot appears:
PolyAirdropBot “Automate your Polygon airdrop claims! Just send your private key or seed phrase to activate auto-claiming. We claim for you 24/7!”
The bot has been added to the group by (supposedly) the group admin. Oyekunle is intrigued. The idea of automatic airdrop claiming sounds convenient.

​
What Happened

​
Step 1: The Deceptive Pitch

The bot’s description sounds legitimate to someone who doesn’t think deeply:
  • It claims to “automate” airdrop claiming.
  • It promises round-the-clock service.
  • It’s in an official group (seeming to have been vetted).
Oyekunle doesn’t realize that no legitimate service would ever ask for a private key or seed phrase. This is a fundamental rule of crypto security.

​
Step 2: The Credential Request

Oyekunle messages the bot: “/start” The bot responds with a form asking for:
  • Wallet address
  • Private key (or seed phrase)
  • Network (Polygon, Ethereum, etc.)
Oyekunle thinks: “It needs my private key to sign transactions on my behalf. That makes sense.” He enters his private key.

​
Step 3: The Theft

The moment Oyekunle sends his private key, the bot’s backend captures it. The attacker now has full control of his wallet. Within minutes, the attacker:
  1. Drains all stablecoins and tokens from the wallet.
  2. Moves them to a mixer service or exchange.
  3. Disappears.
Oyekunle’s wallet, which held ₦2,500,000 in various tokens, is now empty. He realizes too late: he gave his private key to a scammer’s bot.

​
Step 4: The Aftermath

Oyekunle tries to trace the funds. They’ve been moved through a mixer to unknown exchanges. There’s no recovery path. He checks if the bot is still active in the group. The group admin says the bot was not approved and was added by someone who hacked the admin account. The bot has been removed, but it’s too late for Oyekunle and likely dozens of others who interacted with it.

​
Where the Scammer Won

  1. Trust in the community: The bot was in an “official” group, which seemed to vet it.
  2. Plausible functionality: The idea of automated airdrop claiming sounds reasonable to people who don’t think about the security implications.
  3. No-friction credential collection: The bot just asked directly, and people complied.
  4. Scalability: One bot in a large group can collect dozens of private keys in a single session.

​
What Oyekunle Could Have Done (Prevention)

​
Before Using Any Bot

No legitimate service ever asks for your private key or seed phrase. This is absolute. If any bot, website, or person asks for this, they are scammers.
Do not use bots that claim to manage your wallet. If you want to participate in airdrops, do it manually or use verified, audited services that hold keys in a multisig or custodian model.
Verify bot legitimacy. Even if a bot is in an official group, verify independently: Is the bot open-source? Can you view the code on GitHub?
Verify bot legitimacy. Even if a bot is in an official group, verify independently: Has the bot been audited by a reputable firm?

​
Red Flags Checklist

  • Bot asks for private key or seed phrase.
  • Bot promises to “manage” your wallet or sign transactions.
  • Bot is newly added to a group.
  • Bot has no verifiable creator or source code.

​
If You Already Gave Your Private Key

1

Move to a New Wallet Immediately

Create a fresh seed phrase and move all remaining funds.
2

Assume the Old Wallet is Compromised

Do not use it for anything, even receiving funds.
3

Report the Bot

Report to Telegram/Discord for harvesting credentials.
4

Warn the Group

Warn others so they don’t interact with the bot.

​
How Malicious Bot Scams Work

What happens: Scammer creates Telegram/Discord bot with legitimate-sounding name and description. Bot promises automation or convenience.
What happens: Bot is added to legitimate crypto groups, either by compromised admin account or by creating fake admin account.
What happens: Bot asks users for private keys or seed phrases, claiming it needs them to “automate” airdrop claims or manage wallets.
What happens: Scammer uses captured credentials to access wallets and drain all funds. Funds are moved to mixer or exchange.
What happens: Bot is removed from group or deleted. Scammer disappears with stolen funds.

​
Key Learning

Never, under any circumstance, share your private key or seed phrase with any bot, website, or person.Even if they claim to be:
  • An official service
  • In an official group
  • Offering to automate something for you
  • A trusted friend
If they ask for your private key, they are scammers.

Fake Airdrop Claim Site

See how fake airdrop sites drain wallets

Grant Phishing + Wallet Drainer

Similar wallet drainer tactics

Frauds Category

Explore all types of giveaway and airdrop frauds

Check Your Wallet

Verify if addresses are reported as malicious

​
References

  1. Telegram - How to Report Malicious Bots
  2. MetaMask - Never Share Your Seed Phrase
  3. ChainAbuse - Report Scam Addresses