JUST IN: $4.5M Telegram Exploit

A user exploited a vulnerability in Telegram’s bot payment and refund system for nearly two months, amassing approximately $4.5 million worth of Stars.

The flaw reportedly allowed Stars to remain in a user’s balance after a payment, while specific gift purchases triggered refunds that left residual Stars untouched. This loophole enabled repeated cycles, letting the attacker accumulate massive amounts over time.

An estimated $1.5 million was withdrawn before Telegram intervened by blocking gift transfers. The stolen Stars were used to purchase high-value gifts, including rare Plush Pepe NFTs.

CryptoCult