JUST IN: $4.5M Telegram Exploit
A user exploited a flaw in Telegram’s bot payment and refund system for nearly two months, amassing approximately $4.5 million worth of Stars.
The vulnerability reportedly allowed Stars to remain in a user’s balance after a purchase, while specific gift transactions triggered refunds that still left the purchased Stars intact. This loophole enabled repeated cycles, letting the attacker accumulate massive amounts over time.
An estimated $1.5 million was withdrawn before Telegram intervened and disabled gift transfers. The illicit Stars were used to buy high-value gifts, including rare Plush Pepe NFTs.
Crypto Insider
8
3
2
2October 9, 2026 4.1K 1
