Skip to content
Latest alertreth trie bug can make reth, op-reth and Base nodes compute wrong state roots, stall or serve incorrect state proofs
0xCERT
All advisories
Medium0xCERT-2026-0316·

FLOKI trading bot taken offline after exploit; users told to stop depositing into bot wallets

FLOKI says it is investigating an exploit of its trading bot discovered early on 5 Nov 2026 and has taken the bot offline. Do not deposit into bot wallets; users who exported their private key should move remaining funds to a wallet only they control.

Vuln-watch · relayed from a public source; see Source & attribution below

Summary

On 5 November 2026 the FLOKI team announced it is investigating an exploit of the FLOKI trading bot discovered in the early hours of that morning. The bot has been taken offline while the team confirms which users were affected. Affected users will be moved to new, secure wallets and any remaining funds transferred to them.

Affected

  • FLOKI trading bot (@flokitradingbot) user bot wallets; the affected users have not yet been identified publicly
  • No fix available at time of publication; the bot is offline

Impact

The team describes an exploit affecting bot user funds. The root cause, the chains involved, the amount lost and the number of affected users have not been disclosed at time of publication.

Recommended actions

  • Do not deposit funds into your FLOKI bot wallet until further notice.
  • If you exported your bot wallet's private key and it still holds funds, move them to a wallet only you control.
  • FLOKI states its team will never DM you first or ask for your seed phrase or private key; ignore anyone offering "refunds" or "recovery".

Source & attribution

This 0xCERT advisory summarises an announcement by the FLOKI team: https://x.com/FLOKI/status/2118381080260608281. Corroborated by The Defiant (https://thedefiant.io/news/security/floki-takes-trading-bot-offline-amid-exploit-investigation) and listed in SlowMist Hacked (https://hacked.slowmist.io/). Details may change; refer to the original source for the authoritative record.

OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.

Published 2026-11-05 · last updated 2026-11-06

curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0316/signed.txt | gpg --verify