We’re excited to officially introduce OHNO Monkey Bot — a Telegram bot built specifically for project developers looking to push their charts and take control of their market.
- Run Volume Bot strategies with configurable timing and size
- Run Microbuy Bot strategies for repeated small buys
The goal is straightforward: Empower crypto project devs with tools to help push their charts to Valhalla!
Quick Setup Guide
1) Start the bot
Open Telegram and run /start in OHNO Monkey Bot.
2) Fund your wallet
Deposit Base ETH to the wallet you use with the bot.
3) Choose your mode
Volume Bot
Use this when you want recurring buy/sell activity with defined trade ranges and frequency.
Typical inputs:
- Token contract address
- Buy amount range (for example min/max ETH)
- Interval/frequency
- Thread count (if applicable)
- Pool/version preference (where supported)
Example of one message setup:
Start a DM with OHNO Monkey Bot on Telegram, send /start, and send this message:
"set up a volume bot on base chain uniswap v3 for token address 0x000... trading between 0.01 and 0.02 ETH every 10 to 300 seconds"
Microbuy Bot
Use this when you want small, repeated buys over short intervals.
Typical inputs:
- Token contract address
- Funding amount
- Pool/version selection
- Interval (e.g. every X seconds)
- Thread count (affects the speed of the bot)
Example of one message setup:
Start a DM with OHNO Monkey Bot on Telegram, send /start, and send this message:
"please set up a microbuy bot on base chain uniswap v3 for token address 0x000 with 5 second interval and 15 threads and fund it with 0.01 ETH"
4) Confirm and launch
Double-check token address, interval, and budget settings before confirming.
5) Monitor and adjust
Track performance in real time and tune settings as needed. You can always stop the bot, wait a few minutes for it to finish its shutdown cycle, then start a new bot with modified settings. You can run 1 microbuy bot and 1 volume bot at the same time from one account. If you need additional bot instances feel free to use another TG account.
Best Practices for Users
- Start with small sizes while testing parameters
- Verify token contracts before running automation
- Keep strategy intervals realistic for network conditions
- Use separate wallets/risk buckets for experimental setups
- Never share wallet credentials or recovery phrases
- Never store large amount of funds on the main bot wallets, only use it for funding.
Security Incident Update (Important)
Over the past few days, some user wallets connected to our Telegram bot were drained.
This happened due to failures in our own system design and operations, and we take full responsibility.
Our investigation identified two major root causes:
- Webhook trust model was too weak
Incoming Telegram updates were not verified strictly enough, which created room for forged-update risk. - Service-role key handling was careless
A high-privilege Supabaseservice_rolekey was mishandled across environments, increasing blast radius if exposed.
Important architecture change (new)
We are moving away from storing user wallets completely. Instead, users will fund the bot at start time for active sessions/strategies, which significantly reduces long-lived key exposure and removes a major attack vector from our backend.
This change is central to our rebuild: minimize sensitive custody, minimize blast radius, and avoid persistent wallet storage wherever possible.
We are still in the process of moving architectures, but all operations have been secured and isolated.
What we changed immediately
- Tightened webhook verification and request trust boundaries
- Removed prior high-risk credential patterns
- Reduced infrastructure attack surface and tightened controls
- Improved secret management and reduced key sprawl
- Strengthened logging hygiene around sensitive paths
- Began transition to a no persistent user-wallet storage model
We are also implementing deeper defense-in-depth so a single control failure cannot cascade into full compromise.
Reimbursement
We know affected users experienced real loss.
We are actively working on reimbursement plans and will publish a transparent process for impacted accounts.
You trusted us, and in this incident we failed that trust. We are focused on making users whole and rebuilding with stronger security standards.
Official Links
Monkey Bot: https://t.me/OHNOMonkeyBot
Crypto Cabal TG Group: https://t.me/cryptocabalportal
Official X: https://x.com/thebasedcabal
Official website: https://thecabal.app