Telegram malware crypto scams surge 2,000%, outpacing traditional phishing attacks, reports Scam Sniffer.
The Block •
Revision history
4 recorded changes
Want your article here?
Promote with Leviathan NewsBlockchain security firm Scam Sniffer reports that Telegram-based malware crypto scams have surged by more than 2,000% between November 2024 and January 2025, overtaking traditional web-based phishing as a leading vector for stealing digital assets. While losses from conventional phishing remain substantial—estimated at nearly half a billion dollars in 2024—the volume of classic “connect wallet” scams has largely plateaued, even as attacks delivered through Telegram groups, channels, and bots accelerate. According to Scam Sniffer’s data, malicious Telegram activity now represents a distinct, rapidly growing threat profile for crypto users who rely on the messaging app for trading, community coordination, and project updates. The report highlights a tactical shift by attackers from impersonating influencers or using fake websites to embedding malware and social engineering directly into Telegram’s ecosystem. Common patterns include fake verification bots that prompt users to run code or install software, fraudulent trading or airdrop groups, and “exclusive alpha” or insider channels that coax targets into downloading or executing malicious files. Once activated, the malware can exfiltrate passwords, seed phrases, browser data, and connect to multiple wallets, enabling broad compromise from a single infection. Scam Sniffer warns that the combination of Telegram’s high concentration of crypto users and the ability to hide malicious payloads behind seemingly legitimate communities makes these scams particularly dangerous, and it urges users to treat unsolicited group invites, bots, and software downloads with extreme caution.
AI-generated background, compiled from web sources — not editorial content.
More coverage
- Telegram malware scams spike 2,000% as crypto investors face ... (cryptoslate.com)
- Telegram Malware Scams Surge 2,000%, Overtaking Phishing Attacks (cryptorank.io)
- Crypto Phishing on Telegram Surged 2000% Since November 2024 (beincrypto.com)
- Crypto Scams on Telegram Surge: Malware Attacks Skyrocket ... - OKX (okx.com)
- Telegram Faces Surge in Toncoin Scams Targeting User Wallets (yellow.com)
Explore the topic
More on malware
DPRK's BlueNoroff fingerprints crypto wallets before pushing malware via hijacked Telegram accounts and fake Zoom calls
Jumpsec ·
Kaspersky exposes active OkoBot malware targeting hundreds across 25+ countries with crypto wallet and seed phrase theft
Securelist ·
SlowMist uncovers macOS malware that steals Telegram sessions and swaps Ledger, Trezor apps for phishing loaders
slowmist.medium ·
Security researcher Vladimir S. details how organized crypto hacking gangs exploit email, malware, fake support, and wallet approvals to steal millions through scalable social engineering
𝕏/@officer_secret ·
Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch
humanityprotocol.notion.site ·
DPRK-linked Contagious Interview campaign turns Web3 job tests into wallet-stealing malware
𝕏 ·
DPRK's BlueNoroff fingerprints crypto wallets before pushing malware via hijacked Telegram accounts and fake Zoom calls
Jumpsec ·
Kaspersky exposes active OkoBot malware targeting hundreds across 25+ countries with crypto wallet and seed phrase theft
Securelist ·
SlowMist uncovers macOS malware that steals Telegram sessions and swaps Ledger, Trezor apps for phishing loaders
slowmist.medium ·
Security researcher Vladimir S. details how organized crypto hacking gangs exploit email, malware, fake support, and wallet approvals to steal millions through scalable social engineering
𝕏/@officer_secret ·
Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch
humanityprotocol.notion.site ·
DPRK-linked Contagious Interview campaign turns Web3 job tests into wallet-stealing malware
𝕏 ·