DeFi Market
To stop spam bots in a Telegram group, close the doors they walk through: turn on join requests or a captcha check, mute new members' links and media, switch on Telegram's Aggressive Anti-Spam once you pass 200 members, and strip admin rights down to the few people who need them, each with two-step verification on. Most "takeovers" come down to three things: a bot raid, a fake admin, or a real admin who typed a login code into a fake verification bot. Fix the settings first, then the people.
How spam bots take over Telegram groups they don't own
A project's Telegram group is its front door. Investors and journalists check it before the website. Nobody needs to own your group to wreck it. They need one of six ways in.
| Route in | How it works | What stops it |
|---|---|---|
| Mass joins (a raid) | Hundreds of bot accounts join through a public link in minutes and post scam links, porn or "giveaway" spam | Join requests, a captcha check, new-member restrictions, slow mode |
| Fake admins | An account copies an admin's name and photo, then DMs members offering "support" or a wallet "fix" | A pinned rule that admins never DM first, a hidden member list, fast reporting |
| Hijacked admin account | A real admin hands over a login code or session to a fake verification page, and the attacker posts from a trusted name | Two-step verification, session checks, fewer admins |
| Over-powered bots | A bot added as admin with every right, including the right to add new admins, gets compromised or turns out to be malicious | Give bots only the rights their job needs |
| Social-engineered staff | A "partner," "listing agent" or "new mod" talks someone into promoting them | A written rule on who can appoint admins, and one owner account |
| Lookalike groups | A copy of your group, same name and logo, catches people searching for you and runs the scam there | One official link list on your website, reporting as Fake |
A lookalike group never touches yours, but if someone loses money in "your" group, your name is on it.
The scale is real. TechCrunch reported in December 2024 that Telegram's new moderation page counted about 15.4 million groups and channels removed that year for harmful content, fraud included. Scam Sniffer's 2025 phishing report, published January 3, 2026, counted $83.85 million taken from 106,106 victims by wallet-drainer phishing sites. It calls that a lower bound, and it names malicious Telegram bots and fake verification pages among the tactics now aimed at keys and credentials.
The fake verification bot: how admins lose their accounts
Many crypto groups use a "portal": a public channel with a verification bot that checks you're human, then lets you into the real group. Scammers copy the whole setup. They build a lookalike portal, often posing as a popular verification bot called Safeguard, and push people to it from fake X accounts or from DMs inside your group.
In January 2025, BleepingComputer reported a campaign that used fake Ross Ulbricht accounts on X to send people to Telegram channels with a "Safeguard" identity check. At the last step, a Telegram mini app quietly copied a PowerShell command to the clipboard and told users to paste it into the Windows Run box. That command downloaded malware. Other versions skip the malware and simply ask for your phone number and the login code Telegram just sent you. Type it in, and the attacker is logged in as you.
If "you" is an admin, the scam link now comes from a trusted name, pinned, often as an "urgent migration" or "claim your airdrop" post. If that admin could add admins, the attacker promotes their own accounts before anyone notices.
⚠ Red flag
No real verification bot ever needs your Telegram login code, your phone number or a command pasted into Windows Run or PowerShell. Telegram's FAQ says login codes arrive in the official "Telegram" service chat and should never be shared with anyone, including other apps. A bot that asks is stealing your account.
What a spam takeover costs a project
The direct loss is your members' money. A drainer link posted from an admin account can empty wallets in minutes, and people blame the project. Then the slower costs:
- Your real announcements get buried. A raid of a few hundred messages pushes your launch post off the screen.
- New visitors leave. Anyone checking you out finds porn links and "DM me for profits." It reads as an abandoned or fake project, which is one of the signs we teach people to check in how to spot a rug pull.
- Partners notice. A flooded chat undercuts what you spent on promoting the project.
How to stop spam bots in a Telegram group: 10 settings
The first five take ten minutes and stop most raids.
- Turn on join requests for the main group. Telegram lets admins approve new members before they can post, one at a time or in bulk. If that's too slow, use a captcha-style bot in your own portal and point every public link there.
- Restrict new members. In Permissions, block links, media and stickers for everyone, then let trusted roles post them. Most spam is a link or an image.
- Switch on Aggressive Anti-Spam. Telegram's December 2022 update gave admins of groups with more than 200 members an Aggressive mode for its built-in spam filters. Report any real messages it removes from Recent Actions so the filter learns.
- Use slow mode during raids. Telegram added slow mode in August 2019. It limits each member to one message per interval you choose, up to an hour. Turn it up during a raid, then back down.
- Hide the member list. Larger groups can hide members, which makes it harder for scammers to scrape your list and DM everyone in it.
- Make "admins never DM first" a rule people can check. Pin it, put it in the welcome message and the group description, and list your real admin usernames on your website.
- Put one official link list on your website. Group, channel, X, docs. Your site, press kit and press releases should all point to the same list, so a lookalike group has nothing to borrow.
- Separate the channel from the chat. Announcements go in a channel only the team can post in. A spam flood can't bury a channel.
- Audit every bot. Remove unused bots and check each one's exact rights. A captcha bot needs to delete messages and ban users. It doesn't need to add admins.
- Filter the obvious. Block common scam phrases and hide join and leave notices so raids don't fill the screen.
Admin rights hygiene: who should hold what
Telegram's admin rights documentation explains the risk in one line: an admin with the right to add admins can appoint new admins with some or all of their own powers, and remove the ones they appointed. Hand that to the wrong account and the group slips away one promotion at a time.
| Role | Rights it needs | Rights it shouldn't have |
|---|---|---|
| Owner (one account) | Everything. Used rarely, from one device | Never used for daily chat or for clicking links |
| Core team admins (2 or 3) | Delete, ban, pin, add admins only if essential | Change group info if your branding is stable |
| Community mods | Delete messages, ban and restrict users | Add new admins, change group info, manage the channel |
| Captcha or filter bots | Delete messages, ban users, invite users if they run joins | Add new admins, change info, pin |
| Contractors and "partners" | None. Give them a channel post or a guest slot | Any admin right at all |
- Two-step verification on every admin account. Telegram's FAQ says that once it's on, logging in needs both the code and your password. Telegram also requires it before an owner can transfer a group.
- Check Devices or Active Sessions weekly. End anything you don't recognize, and set old sessions to end automatically.
- Keep the owner account cold. It shouldn't be anyone's daily account. If a mod's account falls, the owner can still demote them. If the owner's account falls, you may lose the group.
- Write down who can appoint admins. One person, by name, after a video check. Never promote anyone who asked for it in a DM.
Prefer to watch? How to lock down a crypto Telegram group, in under a minute.
If your group is hijacked: the first hour
- Lock the chat. Turn off sending for all members, or set slow mode to the maximum, while you work.
- Find the bad admin in Recent Actions. It shows who promoted whom. Demote the compromised account and every admin it added. Remove rogue bots.
- Delete and report. On each spam account, use Ban, Report spam and Delete all. Telegram's spam FAQ says admin reports are checked by human moderators.
- Revoke every invite link and make new ones. The raid came in through one of them.
- Secure the hacked account. From a device that's been logged in for a while, end all other sessions, then turn on or reset two-step verification.
- Report impersonation. Report lookalike groups and fake admins from their profile with Report, then Fake Account. The Telegram FAQ points people being impersonated to @NoToScam.
- If the owner account is gone, start a fresh group with a new owner account, post the new link from your website and your X account, and tell members to leave the old one.
How to tell your community
Speed beats polish. Post within the hour on your channel, website and X. Say what happened, which messages were fake, and what not to do:
"An admin account in our Telegram was compromised at 14:10 UTC. Messages about a 'token migration' and 'claim' links posted after that time are fake. Don't click them or connect a wallet. If you did, move your funds to a new wallet and revoke approvals. Our admins never DM first. Official links are only on our website."
Follow up within a day with what you changed. If people lost money, point them to the FBI's ic3.gov and our Scams hub for next steps.
Rob's take
I ran PR for 18 years, and a crisis statement sent in the first hour does more than a perfect one sent the next morning. Teams treat Telegram as a marketing channel and staff it with whoever's free. It's your front door. Give the keys to three people, make them use two-step verification, and write the "we were hacked" post before you need it. You'll be glad it's sitting there.
Want our project and scam guides as they come out? Join the free Sunday Briefing, one email a week.
Not sure whether a site, a message or an offer is a scam? Our is this a scam? quiz takes a minute, and the Scams hub has every guide in one place.
Telegram spam bots FAQ
How do I stop spam bots joining my Telegram group?
Turn on join requests or route new members through a captcha check, and restrict links and media for new members. Groups over 200 members can also switch on Telegram's Aggressive Anti-Spam. Revoke any invite link that a raid came through.
How do spam bots get admin rights in a Telegram group?
Usually through a person. An admin's account gets taken through a fake verification bot, or someone with the right to add admins promotes an account or bot they shouldn't. Limit who can add admins and give bots only the rights their job needs.
What is Telegram's Aggressive Anti-Spam?
It's a stronger setting for Telegram's built-in spam filter, added in December 2022 for groups with more than 200 members. Admins switch it on in the group settings. If it removes a real message, report the mistake from Recent Actions.
How can I tell a fake Telegram verification bot?
A fake one asks for your phone number, your Telegram login code, a wallet connection or a command pasted into Windows Run or PowerShell. A real captcha check asks you to tap a button or solve a simple puzzle. Telegram says login codes should never be shared with anyone.
What do I do if my Telegram group is hijacked?
Lock the chat, demote the compromised admin and every admin it added, revoke invite links and report the spam accounts. Secure the hacked account by ending other sessions and setting two-step verification. If the owner account is lost, start a new group and announce the new link on your website and X.
Should crypto project admins ever DM members first?
No. Make "admins never DM first" a fixed rule, and pin it. Then any account that messages a member first with support or a wallet fix is a scammer, and members can spot it without checking anything else.