More Than $600,000 Stolen In Massive Unibot Exploit

The Telegram trading bot, known as Unibot, has become the subject of a token approval exploit within its recently deployed order router. Unibot pledged to reimburse any funds stolen in response to this exploitation, claiming losses in excess of $600,000.

A dark day for Unibot. The Unibot protocol had been a profitable investment at its peak, attracting the attention of numerous investors. The aforementioned hack is the latest in a long line of cryptocurrency-related exploits, as LastPass users collectively lost $4.4 million in crypto assets last week. More worryingly, numerous Telegram users believe that, despite the company saying otherwise, their keys and wallets may not be safe anymore and many have actively left Unibot altogether.

Damage control Unsurprisingly, the disclosure of the exploit resulted in a significant drop in the price of the token, which was by 33% to $38.50 before recovering slightly, according to data provided by CoinGecko. PeckShield security experts first raised the alarm on October 31st, 2023, in a post on X, estimating that losses over $600,000 in crypto had been recorded.

Telegram confirmed that Unibot indeed suffered a token approval exploit within the new router and have since suspended its operation to address the situation. The company assured users that any assets lost as a result of this vulnerability will be reimbursed, but there has yet to be any announcement regarding potential improvements to security measures to ensure that this does not happen again. Users are also concerned that PeckShield was able to identify the exploit before Telegram itself.