Custody and security rules from GMGN docs · 14 September 2026

Is GMGN safe to use?

GMGN is a legitimate, heavily used platform, but "safe" depends on what you mean. Its wallet model is not what most people assume, most losses come from scams around it, and the tokens it lists can go to zero in minutes. Here is each risk and what you can do about it.

Who holds the keys to a GMGN wallet?

When you log in with Telegram, GMGN generates wallets for you. When you log in with Phantom, GMGN's documentation says it creates "a multi-chain custodial wallet account based on your Phantom wallet", with new addresses on each chain. In both cases the rule is the same: "For the safety of user wallet funds, GMGN all chains (SOL chain / EVM chain / Tron chain) are prohibited from exporting private keys." Even wallets you import cannot be exported again.

In plain terms, you trade from wallets you cannot take elsewhere as keys; to leave, you withdraw the funds. That trade-off is what makes GMGN's speed and automation possible, and it means your account security is your wallet security.

How does GMGN protect withdrawals?

• Google Authenticator is required. Withdrawals stay locked until you bind it.
• Whitelist addresses. Funds can only go to addresses you have whitelisted.
• Time locks. No withdrawals for 3 hours after first setting or changing a whitelist, and 24 hours after re-binding the authenticator. That delay is your window to react if someone gets in.
• No withdrawals from the bot. The Telegram bots send you to the website for withdrawals.

GMGN also recommends using Google Authenticator without cloud sync, so a hacked Google account does not expose every 2FA code at once.

Where do most GMGN losses actually come from?

GMGN's own safety page lists the causes it sees behind stolen funds, and none of them is a platform exploit:

• Fake bots with handles one character off, which take deposits or ask for phone numbers.
• Fake admins who DM after you post in a group. Real admins never message first.
• Infected devices, especially Android phones and Windows PCs that installed unknown apps, and clipboard malware that swaps addresses or reads keys.
• Unofficial Telegram clients or translation plugins.
• Malicious approvals in browser wallets, such as airdropped NFTs linking to a "mint" that drains SOL.

GMGN states it "does not perform any operations on the user's wallet" and cannot transfer user balances. Check every link against our verified GMGN links page.

What about the tokens themselves?

This is the risk no setting removes. Memecoins rug, developers dump, liquidity gets pulled and "Smart Money" wallets lose too. GMGN's own documentation says its security data comes from third parties and is "for reference only". Use it to filter out the obvious: high developer or insider holdings, unburnt liquidity, a first-buyer list that is already selling. Then size positions so a zero does not hurt, and set a stop-loss. Our GMGN setup guide shows how to add exits at the moment you buy.

Your GMGN safety checklist

1. Turn on Telegram two-step verification and block strangers from adding you to groups.
2. Bind Google Authenticator (without cloud sync) and set a withdrawal whitelist.
3. Use only bot handles from GMGN's published list.
4. Never share a private key or seed phrase, with anyone, for any reason.
5. Review and revoke unknown approvals in any browser wallet you connect.
6. Keep only trading money on GMGN; withdraw profits regularly.

What if the worst happens?

GMGN points users to a SlowMist-based process. First, stop the loss: move any remaining assets to a safe address at once. Second, protect the scene: disconnect the affected device from the internet but keep it powered. Third, write down what happened, when, the addresses involved and the amounts. Finally, file the SlowMist stolen funds form, which can flag the attacker's addresses with exchanges.

Safety questions

More detail on costs is in GMGN fees.