"Telegram bot" tells you the interface, not who holds your keys

Telegram trading bots are the fastest-growing way people automate on-chain trades, and the term describes a chat interface rather than an architecture. Two products both accurately called "a Telegram trading bot" can sit at opposite ends of the custody spectrum: one generates a wallet and keeps the key on its own servers, the other never touches a key at all and asks your wallet app to sign.

Buyers reliably assume the label carries information about safety. It does not. Working out which kind you are using is the single most valuable thing you can do before funding one.

We build Tradevo, which is not a Telegram bot, so read accordingly.

The two architectures behind one name

Bot-generated wallet. You message the bot, it creates a wallet and gives you an address, you send funds to it. This is what makes the category feel effortless — no wallet app, no signing prompt, no extension. It also means a key was generated somewhere you do not control. Security researchers have repeatedly flagged that some implementations retain a copy of that key on the operator's infrastructure even where users can export it, and that whether keys are held server-side is frequently not disclosed clearly. If the operator's servers are compromised, every wallet created that way is exposed at once.

Connected wallet. The bot holds no key. It builds a transaction and your own wallet app signs it, usually over WalletConnect. Slower, more taps, and the operator cannot move anything without you.

Both are Telegram bots. Only one of them is a custody question, and the interface looks nearly identical from the inside.

The worst version, and it is common

Importing an existing seed phrase into a bot is categorically different from letting it generate a fresh wallet, and it is worth separating because people do it for convenience.

A generated wallet bounds the exposure to whatever you sent it. A seed phrase you paste in exposes every account that phrase derives — including ones the bot has no business knowing about — permanently and irrevocably, because a seed phrase cannot be un-shared. No amount of the operator behaving well changes what you have handed over. The Block reported security researchers raising exactly this as the category grew.

If a product asks for a seed phrase, that is the end of the evaluation.

The question to ask

If this operator disappeared tonight, could I still move my funds — and could anyone else?

• Bot-generated wallet, key exportable, no copy retained: you can move funds; whether anyone else can depends entirely on a claim you cannot verify.
• Bot-generated wallet, key held server-side: you are relying on the operator both to exist and to be honest. That is custody, whatever the marketing calls it.
• Connected wallet: you can move funds and nobody else can. The operator was never able to.
• Seed phrase imported: everything that phrase derives is exposed, permanently.

Where Tradevo sits, and what it costs

Tradevo generates a wallet too — the keys are held by the user and exportable at any time — and executes on Base through an authorisation scoped to swapping allowlisted assets up to the amount allocated. It cannot transfer, cannot withdraw, and cannot reach anything unallocated.

The honest limit: that authorisation is removed when you cancel, and that removal is something we perform rather than something you trigger without us. A connected-wallet bot is stronger on exactly that point, because there was never a standing permission to remove.

When a Telegram bot is the better choice

You are trading new tokens in the first minutes. This is what the category exists for and it is genuinely good at it. A scheduled on-chain executor is not competing here and would be worse at it in every respect.

You want to act from your phone in seconds. Chat is a superb interface for that. Nothing about our model is faster.

You have chosen a connected-wallet implementation. If the bot never holds a key, the main architectural objection disappears and what remains is a convenience question.

You are deliberately using a small, funded-for-the-purpose wallet. Bounding exposure by only sending what you can afford to lose is a legitimate strategy, and it makes the custody question much smaller.

When a scoped signing authorisation fits better

You want a bounded standing permission rather than an unbounded one. An allowlist and a cap are narrower than a key.

You want the strategy to run without you. Chat bots are reactive by design; you are the trigger. A scheduled executor is the opposite, and if you want something running while you are asleep, that is the difference.

You want every action publicly checkable. Executions are transactions on Base you can inspect without asking anyone.

Check for yourself: Cointelegraph — security firms on Telegram bot custody · The Block — security vulnerabilities in Telegram crypto bots · Tradevo's method

Tradevo Technologies builds evidence infrastructure for systematic trading. Nothing on this page is investment advice, and no part of it describes how any strategy performed. Crypto assets are volatile and you can lose your entire allocation.