JUST IN: $4.5M TELEGRAM EXPLOIT

A hacker exploited a flaw in Telegram’s bot payment and refund system over nearly two months, siphoning off around $4.5 million worth of Stars.

The vulnerability allegedly allowed Stars to stay in a user’s balance after making a payment. At the same time, certain gift purchases triggered refunds—yet left behind residual Stars. This created a loop that the attacker repeated, steadily accumulating large amounts.

Roughly $1.5 million was withdrawn before Telegram stepped in and blocked gift transfers. The stolen Stars were used to buy premium gifts, including rare Plush Pepe NFTs.