Common Telegram Crypto Scams to Recognize

Telegram is where a huge share of genuine cryptocurrency activity actually happens, from project announcements to trading communities to customer support. That same openness is exactly why it has also become one of the most heavily used platforms for crypto fraud. Security researchers tracking the platform through 2025 identified more than 340 fraudulent trading bots active over the course of the year, with an average lifespan of only 45 days before being reported and shut down, meaning new ones are constantly replacing them.

Why Telegram attracts crypto scammers specifically

Telegram allows anyone to create a bot, a channel, or a group with almost no verification, and it does not offer a verified badge system that would let a user reliably distinguish an official project bot from an impersonator. A scammer can name a bot something like MetaMask Official Support and present it convincingly to anyone unfamiliar with how little that name actually proves. Combined with large public crypto communities full of people actively looking to trade, invest, or get help, Telegram gives scammers both the audience and the anonymity they need in one place.

The most common scam types on Telegram

• Fake trading and signal bots that promise automated profits in exchange for connecting a wallet or sending funds to a managed address
• Pump and dump groups that hype a low value token to attract buyers before the organizers sell their own holdings and disappear
• Impersonation accounts posing as official support for a wallet, exchange, or project, usually reaching out first after spotting someone post a public question
• Fake airdrop and token claim campaigns that ask for a wallet connection or a small gas fee payment to release tokens that do not exist
• Admin impersonation inside real project groups, where a compromised or fake account with a matching name and photo privately messages members offering help

Fake trading and signal bots

These bots are often advertised with polished marketing, fabricated performance charts, and testimonials from accounts that are themselves fake. They typically ask a user to deposit funds into a wallet the bot controls, promising automated trades and daily returns. Some early users are allowed to withdraw small amounts to build credibility inside the group before the bot stops honoring withdrawal requests entirely.

Impersonation of official support

This pattern usually begins when someone posts a genuine question in a public support group, such as a wallet not syncing or a transaction not appearing. Within minutes, an account styled to look like an official moderator or support representative sends a private message offering to help, then asks for a seed phrase, a private key, or remote access to a device. No legitimate support team will ever ask for either of those, under any circumstance, and this remains true across every wallet and exchange.

Pump and dump groups in detail

These groups typically present themselves as exclusive trading communities offering early access to a token about to take off, sometimes charging a subscription fee just to join. Organizers, who already hold a large position in the token, post fabricated chart analysis, screenshots of supposed insider information, or countdowns to a coordinated buy signal. When the signal is given, members buy in together, briefly pushing the price up in a genuinely visible way that reinforces the group's credibility for the next round. The organizers then sell into that same rally, and the price collapses within minutes, leaving everyone who bought in after them holding a token worth a fraction of what they paid.

A step by step walkthrough of a fake airdrop scam

Fake airdrop campaigns follow a consistent sequence that is worth understanding in detail, since recognizing any single step early can stop the whole thing before real damage occurs.

• An announcement appears in a group or channel, sometimes made to look like it is from a real, well known project, claiming a limited token distribution to early community members
• A link directs users to a website that mimics a legitimate claim page, often with a countdown timer designed to discourage careful review
• The site asks the user to connect a wallet, which alone does not steal anything but begins building a false sense that the process is normal and safe
• A transaction request appears, described as a gas fee, a verification step, or a signature needed to prove eligibility, but the actual permission being requested grants the site the ability to move assets out of the wallet
• Once signed, the attacker drains available tokens immediately, or in some versions waits and drains later once several victims have accumulated to avoid drawing attention to a single large theft

How a typical Telegram scam unfolds

Most cases follow a similar shape regardless of which specific scam type is involved. Contact usually happens quickly, either through an unsolicited direct message or a reply to something posted publicly. The pitch relies on urgency, a limited time bonus, a closing window for an airdrop, or a support ticket that needs immediate action. A link or bot is provided that looks legitimate enough not to raise alarm on a quick glance. Once a wallet is connected or funds are sent, the scammer either drains what they can access or simply stops responding.

Why this is structurally hard for the platform to stop

Reported Telegram specific fraud grew significantly year over year through 2025, and blockchain security researchers have separately documented an enormous surge in Telegram based crypto malware activity over the same period. Part of the difficulty is architectural. Bots can be created instantly by anyone, channels can be renamed and rebranded after being reported, and the same operator can run dozens of nearly identical scams in parallel, so removing one has little effect on the broader operation.

Protecting yourself on Telegram

• Treat every unsolicited direct message about crypto, especially one offering help or an opportunity, as a scam until proven otherwise
• Never send a seed phrase, private key, or remote device access to anyone, regardless of how official their profile looks
• Verify any bot, channel, or link independently through a project's official website rather than trusting a link shared inside Telegram itself
• Be skeptical of any trading bot, signal group, or investment opportunity that guarantees returns or shows performance you cannot independently verify
• Assume that admin badges, profile photos, and display names inside Telegram groups can all be copied convincingly by an impersonator
• Turn on two factor authentication for your own Telegram account, since a compromised account is sometimes used to message your own contacts asking for money
• Leave large public groups that have a history of pump and dump activity or unverifiable trading bots, since remaining a member increases the volume of unsolicited contact you receive

Recognizing when a friend is being targeted

Because Telegram groups often function as genuine communities, it is common to watch a friend or acquaintance get drawn into a scam happening in real time, sometimes in the same group chat you are both part of. Signs worth raising include a member who suddenly becomes an enthusiastic promoter of a bot or token they only just discovered, someone posting screenshots of gains that seem inconsistent with how new or obscure the platform is, or a member who begins encouraging others to deposit larger amounts shortly after joining themselves, which can indicate they are being used, knowingly or not, to recruit further victims. A private, direct message asking what due diligence they have done, and sharing a specific concern rather than a vague warning, tends to be taken more seriously than a general comment posted in the group itself, which a scam operator may quickly delete or bury.

These same impersonation and bot based patterns show up heavily on other messaging platforms as well. See our guides on how WhatsApp crypto scams typically begin and Discord crypto scams and what to watch for for how the tactics differ by platform.

What to do if you have already connected a wallet or sent funds

If you signed a transaction requested by a suspicious bot or link, the first priority is checking and revoking any token approvals granted to that contract, since a signed approval can allow further withdrawals even after the initial theft. Our guide on how to revoke token approvals walks through this process using a reputable approval checking tool. Move any remaining assets in the affected wallet to a new wallet with a freshly generated seed phrase, since an attacker who gained access once may return for anything left behind.

If cryptocurrency was sent directly to a wallet address rather than drained through a signed approval, document the transaction hash, the destination address, and every message from the bot or account involved before it disappears or is deleted. Report the account or bot to Telegram directly, since this can help get it removed even though it will not recover funds already sent, and file a report with the FBI's Internet Crime Complaint Center. Our guide on the first 24 hours after a crypto theft covers the fuller sequence of steps in more detail, including how to preserve evidence in a form that is useful to investigators later.

Frequently asked questions

Sources and further reading

• Common Telegram Crypto Scams and How to Spot Them · Analytics Insight
• The 12 Latest Telegram App Scams To Avoid · Aura

Related reading