Last night, news broke about the largest Telegram Stars refund to date.
According to reports, a user from the Arab region exploited a vulnerability for two months, managing to trick users out of a total of approximately $4.5 million in Stars. However, only about $1.5 million was successfully withdrawn.
How did the scheme work?
According to participants, the vulnerability was related to payments made through a bot. After making a payment, Stars would appear in the user's balance. However, when purchasing a gift NFT worth 100,000 Stars, the funds were instantly returned.
This created a discrepancy: 100,000 Stars were deducted from the user's account, but after the refund, 80,000 Stars remained. This allowed the user to repeat the operation and accumulate Stars seemingly out of thin air.
🎁The accumulated Stars were used to purchase expensive gifts, including three Plush Pepe NFTs with a black background.
The good times didn't last long: the ability to transfer gifts for participants in the scheme has already been blocked. A significant loss is the PlushPepe-84 - this gift is irretrievably lost because it was located on an account, not in a blockchain wallet.
🎨@ComWires | News • NFTs