Curriculum·S210 Automation Literacy: What Bots Actually Do·about 30 min
The bot taxonomy
By the end of this lesson you can
- →Classify any automation by where the keys live and what authority it holds
- →Distinguish a signal service, an execution tool and a custodial agent, and price the difference
- →Identify what a bot can do at its maximum, independent of what it normally does
- →Choose the least-authority form that accomplishes a stated task
Sophomore · enrolled learners
This lesson opens with Banana Gun, September 2024.
- What happened
- In September 2024 attackers exploited a vulnerability in a Telegram message oracle used by the Banana Gun trading bot, allowing them to manually initiate ETH transfers from victims' wallets while those users were actively trading. Approximately $3M was drained. Fewer than 40 users were affected out of a reported base of more than 10,000. The operator shut the bots down, patched the vulnerability before reactivation, reimbursed affected users in full from its treasury, added a two-hour transfer delay and two-factor authentication on transfers, and commissioned external penetration testing. Similar exploits were reported against other Telegram trading bots in the same period, with one losing around $200,000.
- The decision point
- The vulnerability was not in the trading logic. It was in the messaging layer through which the bot received instructions, which most users would not have identified as part of the product at all. Where the keys live determines the maximum loss, and for this category the keys live with the operator, which means the maximum loss is everything regardless of what the strategy does.
- Recorded loss
- $3,000,000
What you will be able to answer
- →What is the first classification question for any bot?
- →Name the three authority levels.
- →What was exploited at Banana Gun?
- →How do you choose a form?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://cointelegraph.com/news/telegram-bot-banana-gun-users-drained-500-ether
- https://www.quillaudits.com/blog/hack-analysis/banana-gun-exploit
- https://rekt.news/bananagun-rekt
- https://3commas.io/blog/api-security-incident-faq
Confidence medium·Volatility high·Reviewed 2026-08-06·Owner unassigned
Contested
The operator reimbursed affected users in full from its own treasury and improved its controls, which should always be stated alongside the incident. That is a discretionary remedy per F107-04 rather than a protection users held.
Named products in this category change constantly. Teach the classification by key custody and authority, not any current product.