Hacker drains $600,000 from Telegram’s Unibot

An exploit affected Unibot, a trading bot used on Telegram, and led to the exploitation of user accounts. Scopescan, a research team tracking blockchain activity, noticed the exploit and posted about it on Twitter. They also reported that the hacker is selling the stolen assets for ETH on decentralized exchanges.

Reports indicate that approximately one hour after the exploit occurred, losses had already reached $600,000.

“Please check and revoke the approvals for [Unibot’s] contract,” Scopescan said. “Move your funds to a new wallet ASAP.”

Beosin Alert blamed the exploit on a Call injection, allowing the attacker to transfer assets from wallets that had not revoked their approval of Unibot’s smart contracts.

🚨#Unibot exploited🚨
Hacker:https://t.co/vSnl9xNmBD

The root cause is CAll injection, where an attacker can pass custom malicious calldata into the 0xb2bd16ab() method to transfer tokens approved to Unibot contracts.

Users need to revoke approval for… pic.twitter.com/7PYJVwO6Ga

— Beosin Alert (@BeosinAlert) October 31, 2023

Although the official Unibot Twitter account has stated the cause of the hack, CoinGecko’s data reveals that the Unibot token’s price dropped by 29% in the hour following the hack. The current market cap of the Unibot token is around $45 million, down from its all-time high of $200 million in August.

Meanwhile, Dune Analytics reports that around 1,300 active Unibot accounts existed in the 90 days leading up to the current date. Based on available data, Unibot ranks as the second most popular Telegram bot, with 16% of the total user base.

While trading bots on Telegram have gained popularity, users must remain aware of associated security risks, including the relinquishment of control of their private keys when using a bot.

One week ago, hackers stole $500,000 from the top Telegram trading bot at that time, called Maestro. The developers of Maestro later refunded users affected by the hack.

In September, due to a smart contract error, the native token for Banana Gun, the most popular Telegram trading bot at that time, crashed by 98%. Banana Gun then relaunched the token.

Read also: The need for interoperability across multiple bank chains: experts share insights