The Bot Is the Bait: Telegram and Discord Phishing in 2026

The message did not land in an inbox. It landed in a Telegram group you joined on purpose, posted by a bot wearing a verified badge, moments after someone you had been chatting with for a week vouched for the project. The bot said it had to confirm you were human before you could claim an allocation. All you had to do was copy a short line, press Win and R, and hit enter. A minute later the wallet on that same laptop was empty, and so was the one on your hardware device that you had plugged in to check a balance.

That is the shape of crypto phishing in 2026. The lure is no longer a stray email or a typo-squatted link waiting in search results. It is a chat message inside the exact community where you went to be among friends, carrying the one thing those communities run on: trust in a bot, a badge, a pinned announcement, or a familiar handle. The attackers did not get better at reaching strangers. They moved to where the people with money already gather, and they turned the furniture of those rooms against the people sitting in them.

This piece is about that migration. Not the malicious signature itself, not the drainer kit that signs it, and not the laundering that follows, all of which this outlet has covered before, but the delivery layer that now dominates: Telegram and Discord, the two apps where crypto actually lives, and the bots, servers, and direct messages that have become the most productive phishing surface in the market.

The Call Is Coming From Inside the Server

For most of crypto’s history, a phishing campaign meant casting the widest possible net. Buy a batch of look-alike domains, rent a wallet drainer, flood search ads and comment sections with fake mint links, and skim whatever the net caught. That machine still runs, but it is a shadow of what it was. According to Scam Sniffer’s 2025 annual report, on-chain wallet-drainer phishing stole about $83.85 million from 106,106 victims, down 83 percent in losses and 68 percent in victims from roughly $494 million and 332,000 victims a year earlier.

Those numbers look like a win. They are not. The broad fraud category that sits above drainers kept growing: Chainalysis estimated that crypto scams drew around $17 billion in 2025, with impersonation scams up more than 1,400 percent year over year and the average payment to a scam rising from $782 to $2,764. The mass net shrank; the targeted spear got sharper. Scam Sniffer’s January 2026 snapshot made the shift literal: signature phishing losses jumped 207 percent over the prior month to $6.27 million, even as the victim count fell, because two wallets alone accounted for about 65 percent of the month’s losses. Fewer people, far bigger fish.

Whale hunting changes the geography of an attack. You cannot catch a specific high-value target with a billboard. You have to go where they are, earn a shred of context, and strike inside a channel they already trust. In crypto, that channel is almost always a chat app. Projects coordinate on Discord. Traders live in Telegram. Founders, moderators, and support desks are reachable by direct message. The result is a threat model that firewalls, email filters, and ad blockers never see, because the attack arrives through the front door the victim walked in by choice.

Why the Chat App Became the Battlefield

Telegram and Discord are not just where crypto communities talk. They are where crypto communities grant authority. A Discord server hands out roles, gates channels behind verification bots, and treats the pinned announcement as gospel. A Telegram group leans on admin badges, forwarded messages from official channels, and bots that trade, snipe, and moderate on members’ behalf. Every one of those conventions is a trust signal, and every trust signal is something an attacker can forge or steal.

Three features of these platforms make them ideal hunting grounds. First, bots are normalized. Users are trained to add bots, click bot buttons, and let bots gate their access, so a malicious bot does not look out of place. Second, identity is soft. A verified badge on X or a copied avatar on Telegram is enough to pass a glance, and the real project’s name sits one invisible character away from the fake. Third, urgency is built in. Allocations close, mints sell out, and verification windows expire, so the platform’s own tempo does the attacker’s pacing for them.

Put those together and you get a venue where a stranger can look official, act with authority, and manufacture a deadline, all without tripping a single technical alarm. The defensive stack that the industry spent years building, transaction simulation, link blocklists, hardware wallets, clear signing, is tuned to catch a bad transaction or a bad URL. A chat message that asks you to paste a command into your own terminal, or to type your recovery phrase into a bot, sails past all of it, because at the moment it matters there is no transaction and no link to inspect. There is only a conversation, and you are losing it.

The Fake Safeguard Bot: Verification as a Weapon

The clearest emblem of the chat-app turn is the fake verification bot. Scam Sniffer first flagged the specific combination in December 2024, and it has since hardened into a template. The flow begins on X, where a cloned account impersonating a well-known founder or project (often with a purchased blue check) promotes a Telegram group. Inside the group, a bot named something like OfficiaISafeguardBot greets new arrivals. Read that handle again: the lowercase l in Official has been swapped for a capital I, a substitution most fonts render identically. The bot announces that, to keep scammers out, every member must complete a quick human-verification step.

The step is the attack. The bot instructs the victim to press Win and R to open the Windows Run dialog, paste a string the bot has quietly placed on the clipboard, and hit enter. That string is a command that pulls down and runs malware, typically an infostealer that rakes the machine for wallet files, browser sessions, seed phrases saved in notes, and the victim’s own Telegram session. Cointelegraph, citing Scam Sniffer, reported that the firm had seen roughly 300 impersonator accounts a day during the campaign’s peak and at least $3 million in losses, and quoted the firm’s analysts saying it was “the first time we’re seeing this specific combination of fake X accounts, fake Telegram channels and malicious Telegram bots.”

What makes the Safeguard playbook durable is that it never asks for anything that looks like theft. It does not request a signature. It does not show a transaction. It does not even present a link to a drainer site. It asks the victim to run a maintenance step, framed as protection, and the victim does the dangerous part with their own hands. By the time any wallet software could have warned about a risky approval, the keys are already gone, copied straight off the disk.

ClickFix: How a Captcha Becomes a Command

The technique under the Safeguard bot has a name: ClickFix. It is the connective tissue of the modern chat-app con, and it works because it inverts the usual phishing relationship. Instead of tricking a victim into clicking something malicious, it convinces the victim to fix a fake problem by running a command themselves. A page or a bot claims that a captcha failed, that audio is broken, or that a verification is incomplete, then presents a helpful remedy: copy this code, open Run or Terminal, paste, and press enter.

On Windows the remedy usually opens the Run dialog or PowerShell; on macOS it opens Terminal and pipes a script through the shell. Either way the clipboard already holds a payload the victim never typed, and the command fetches a stealer or a remote-access trojan from an attacker server. Because the victim runs the code on their own machine, the attack crosses operating systems, evades link blocklists (there is no malicious link to block), and defeats email scanners (there is no email). It is, in the most literal sense, self-service malware.

The important thing to internalize is the boundary ClickFix exploits. A legitimate Telegram group never needs you to run a command to prove you are human. A real Discord verification never asks you to open PowerShell. No honest bot, anywhere, requires Win and R. The instruction to execute code is the whole exploit; everything before it (the cloned founder, the urgent allocation, the official-looking bot) exists only to get you to that keystroke. If you learn one rule from this article, make it that one.

Anatomy of a Fake Verification Attack

Stripped to its parts, the campaign is a relay. Each stage borrows trust from the last and hands it to the next, and the victim only sees the friendly surface at every step.

Fake Trading Bots and the Seed-Phrase Trap

Telegram did not just become a place to talk about trading. It became a place to trade. A generation of Telegram-native bots, sniper bots and meme-coin bots that buy, sell, and front-run inside a chat window, pulled in enormous volume by removing every step between seeing a token and buying it. That convenience created a second, quieter phishing surface, because to trade from a chat you have to give the bot a key.

Impersonators exploit exactly that expectation. A clone bot copies the name and avatar of a popular trading bot, registers a handle one character off, and seeds it through comment spam, fake support replies, and hijacked group links. When a user starts the clone, the setup flow asks them to import an existing wallet by pasting a seed phrase or private key, which the real bots are built specifically never to request in that way. The moment the phrase hits the chat, the wallet is swept. The lesson security teams repeat is blunt: a bot that asks for your seed phrase is the attack, full stop, and no savings wallet should ever be imported into a chat bot.

Even the genuine bots concentrate risk in a way that should give pause. In September 2024, users of the legitimate Banana Gun bot were drained of about $1.9 million, hitting roughly three dozen accounts out of more than 10,000 users managing around $100 million; security analysts traced it to isolated accounts rather than a platform-wide contract flaw. Whether the keys leak through a clone bot or an incident at a real one, the structural point stands: a hot wallet wired into a chat application is a wallet you have partly handed to the room. The crypto-native answer is the same discipline that protects any key you cannot afford to lose: keep a small, disposable hot wallet for bot trading and keep your savings on a device that never touches a chat.

Discord: When the Announcement Channel Turns Hostile

If Telegram is where the fake bot thrives, Discord is where the fake announcement does. The pattern is almost monotonous in its reliability. An attacker phishes a moderator’s credentials, steals an admin’s browser session, or hijacks a bot token with posting rights. With that foothold, they publish a message in the official announcement channel, usually a surprise mint, a stealth airdrop, or an emergency migration, with a link to a drainer site. Because the post comes from the real server, through a real role or a real webhook, members treat it as official and connect their wallets. The project team notices within minutes and reverts the message, but minutes are all a drainer needs.

Webhooks make this worse than a simple account takeover. A Discord webhook is a posting endpoint that can speak in a channel without logging in as a person, so a leaked webhook URL lets an attacker drop an announcement that looks system-generated and survives a password reset on the compromised human account. The announcement channel, the most authoritative surface a project has, becomes a megaphone pointed at its own community.

No crew industrialized this better than Pink Drainer. The group specialized in compromising Discord servers and X accounts, often by first impersonating a crypto journalist and walking a target through a fake interview that ended with the victim installing a malicious bot or bookmarklet that stole their Discord token. BleepingComputer documented a single such run that netted about $3 million by impersonating journalists, with victims including high-profile figures and projects. Earlier, Orbiter Finance’s Discord was compromised in a Pink Drainer operation that drained roughly $213,000. Across its life the kit was tied to more than $85 million stolen from over 21,100 victims before the operators walked away. When the group shut down, the on-chain investigator ZachXBT surfaced their own sign-off, which read: “We have reached our goal now, and according to plan, it’s time for us to retire.” Phishing crews now retire like startups that hit their raise.

Invite Hijacking and the Infostealer Pipeline

Compromising a live server is noisy. A subtler Discord vector hijacks the way communities invite people in the first place. Check Point Research detailed a campaign that abused Discord’s vanity invite system: when a temporary invite expires or a permanent one is deleted, its code can become available again, and an attacker with a boosted server can reclaim that exact code. Old links, posted months earlier on project websites and in Telegram channels by legitimate communities, suddenly route new arrivals to an attacker-controlled server instead.

From there the script is familiar. The fake server shows a slick verification page, a ClickFix captcha that looks broken, and a prompt to run a PowerShell command. The payloads Check Point observed are a menagerie of commodity malware: AsyncRAT for full remote control, the Skuld stealer tuned to hunt Exodus and Atomic wallets along with browser credentials and Discord tokens, and ChromeKatz to lift cookies. The researchers counted more than 1,300 downloads of the staged payloads and victims across the United States, Vietnam, France, Germany, Slovakia, Austria, the Netherlands, and the United Kingdom.

The Skuld detail matters because it closes a loop. One of the things it steals is the victim’s Discord token, which is the credential that lets the attacker post as that user, which is how the next server gets compromised and the next batch of announcements goes out. The infostealer that a phishing page installs today becomes the account-takeover tool that seeds tomorrow’s phishing. The chat-app economy is self-feeding, and a drained wallet is often just the first withdrawal; the stolen identity keeps paying out long after.

The Chat-App Phishing Playbook

The campaigns differ in surface but rhyme in structure. Each one borrows a native trust signal, abuses it to deliver either a command or a credential request, and ends in a drain. Mapping them side by side makes the common seam obvious, and it shows why a single habit (refuse to run code or reveal a secret inside a chat) breaks most of them at once.

Support Impersonation: The DM That Finds You First

Not every chat-app attack needs a bot or a server breach. The oldest and most reliable version is a direct message. You post in a public channel that your swap failed or your wallet looks wrong, and within minutes a friendly account with the project’s name and logo slides into your DMs offering to help. It copies the brand down to the avatar, speaks the language of a support desk, and nudges you out of the public channel where other members might warn you, into a private chat where it is just the two of you.

From there the ask is always a secret: a login code, a phone number paired with a one-time passcode, a 2FA token, or the recovery phrase itself, each framed as a necessary verification step. A common variant skips the technical theft entirely and offers to recover funds you already lost, for a fee paid up front, which is how victims of one scam get farmed a second time. The structural tell never changes and is worth memorizing: legitimate support does not message you first, does not move you to a private chat to help, and never needs your seed phrase. An unsolicited helper is a predator by default.

This is also where the line between a chat-app con and a corporate breach blurs, because support impersonation runs in both directions. Attackers impersonate a project’s help desk to reach users, and they impersonate users to reach a project’s real help desk, talking a contractor into a password reset or a device swap. The same social muscles that drain a retail wallet through a Telegram DM can, pointed at an insider, open a far larger door.

The $6.3 Billion Backdrop: Why Humans Are the Target

To understand why so much attacker energy has flowed into social channels, look at the biggest heist in the market’s history, which happened days before this was written. On October 29, 2026, attackers drained about $6.3 billion from Binance’s hot wallets, most of it inside an hour, in what analysts called the largest crypto theft ever recorded. The mechanism on Ethereum was an EIP-7702 delegation: the attacker used valid signatures from Binance-controlled keys to point a hot wallet’s code at an attacker-controlled sweeper, draining one exchange wallet of roughly $2.5 billion in a single transaction. TRM Labs and Chainalysis both attributed the operation to the North Korean group TraderTraitor, the same crew behind the $1.5 billion Bybit theft in February 2025.

The detail that matters here is the entry point. By Binance’s own account, the breach did not begin with a smart-contract bug or a cryptographic break. It began with a compromised DevOps engineer’s laptop that reached a service container with withdrawal rights. The signatures were valid; the code did what it was told. As MetaMask’s Taylor Monahan has argued about EIP-7702 drains since they first appeared, the failure is a stolen-key and phishing problem, not a flaw in the upgrade. The machinery that moved $6.3 billion was triggered by a human and an endpoint, not an exploit in the usual sense, and the aftermath is already spilling into the market’s plumbing, from frozen funds to the bot swarms that fed on the fallout.

That is the whole thesis in one event. When even the best-defended venue on earth is breached through a person rather than a contract, the economics of attack tilt decisively toward social engineering. Binance had a DevOps laptop to compromise. Everyone else has a Telegram group and a Discord server, and that is where the compromise comes for them.

AI Turns One Scammer Into a Thousand

The chat-app shift would be manageable if each campaign still needed a fluent human to run it. Generative AI removed that bottleneck. A model can now write the cloned founder’s posts, hold a convincing Telegram conversation in a dozen languages, generate the verification page, and voice a support agent on a call, all at a cost that rounds to zero. Chainalysis found that AI-enabled scams were about 4.5 times more profitable than non-AI operations, and that impersonation, the category most of these chat-app plays fall under, grew more than 1,400 percent in a year.

The believability upgrade is the dangerous part. Jacqueline Burns Koven, Chainalysis’s head of cyber threat intelligence, warned about the potential of AI to exponentially scale crypto scams, and the mechanism is visible in every chat-app vector above. The fake support agent no longer writes in broken English. The cloned founder answers follow-up questions in real time. The voice on the recovery call sounds like a person because it is a model trained on one. When the cost of a bespoke lure collapses, whale hunting stops being expensive, and the two wallets that made up 65 percent of January’s losses stop being outliers.

Seen over two years, the market did not get safer; it bifurcated. One lane, the mass drainer, shrank hard. The other, targeted impersonation supercharged by AI, exploded. The same split shows up in the token manias that feed the lures, where hype around AI-agent projects and ghost tokens gives cloners an endless supply of plausible airdrops to impersonate.

Following the Money and the Long Odds of Recovery

Once a wallet is drained through a chat app, the funds move fast and the odds of getting them back are poor. Proceeds typically hop through a swap, then into a privacy tool or a cross-chain bridge, then into a mixer, with the whole chain often completing before the victim has finished filing a report. The laundering infrastructure is professionalized in the same way the phishing kits are, and it is the part regulators and investigators find hardest to touch, as this outlet has traced in the compliance pressure now building around DeFi rails.

The bright spot, such as it is, comes from stablecoin issuers and analytics firms coordinating freezes faster than before. When Brazil’s Mercado Bitcoin was drained of about $40 million across more than ten chains in a late-2026 incident, it reported blocking roughly $11 million within hours by working with Tether, Circle, Paxos, and Chainalysis. Binance similarly said about $3 billion of its stolen $6.3 billion had been frozen on chain. Freezing works best against centralized stablecoins and large, slow-moving sums; it does little for the retail victim whose phished ether vanished into a mixer in ten minutes.

In the United States, the enforcement picture runs through several agencies at once. The FBI’s Internet Crime Complaint Center logs the losses and issues the public warnings, the Department of Justice brings the seizures and indictments, and the Securities and Exchange Commission pursues the fraudulent-offering and impersonation cases that touch investment products. The SEC and its peers have gotten better at charging the operators they can identify and clawing back the funds they can trace, but the base rate for an individual victim remains grim. For most people drained through a chat app, the realistic outcome is a police report, a tax write-off conversation, and a hard lesson. Prevention is not one defense among many; it is effectively the only one that works.

Hardening Yourself Against the Chat-App Con

Because recovery is rare and the attack arrives inside a trusted room, defense is almost entirely a matter of habit. The good news is that one principle disarms most of these campaigns at once: nothing legitimate in crypto requires you to run a command or reveal a secret inside a chat. Everything else is a corollary of that rule.

• Treat any instruction to run a command, open Run, PowerShell, or Terminal, or press Win and R as an attack, no matter how official the source looks.
• Never type or paste a seed phrase or private key into a bot, a website, or a direct message; no honest tool needs it to let you in or to trade.
• Read bot and account handles character by character, and watch for a capital I standing in for a lowercase l, or an extra letter buried in a long name.
• Confirm every mint, airdrop, and migration on the project’s official website, reached independently, rather than through a link posted in Discord or Telegram.
• Assume unsolicited support agents, admins, journalists, and recruiters are hostile until you verify them through a second, separate channel.
• Lock down Discord: enable two-factor authentication, disable direct messages from server members, and abandon any verification page that asks you to run code.
• Keep a small, disposable hot wallet for chat-bot trading and keep savings on a hardware wallet that never touches a chat app.
• Prefer wallets with transaction simulation and drainer blocklists such as Blockaid and Scam Sniffer, and periodically revoke stale approvals at revoke.cash.

It is worth being honest about what the industry’s flagship fixes do and do not cover. Clear signing, the what-you-see-is-what-you-sign standard ERC-7730 that the Ethereum Foundation took stewardship of in May 2026, closes the blind-signing gap blamed for heists like Bybit, and hardware wallets keep a private key off an infected computer. Both are real progress. Neither helps against ClickFix malware that copies a seed phrase off your disk, or against a victim who types their recovery words into a bot, because the chat-app con is designed precisely to avoid the signing moment those tools guard.

The direction of travel is not encouraging. The brands worth cloning are the ones with the most users and the fattest allocations to dangle, from the leading DEXs to perps venues like Hyperliquid, so a name you recognize should raise suspicion, not lower it. As wallets, exchanges, and even consumer apps race to embed AI agents that hold keys and act on your behalf, the number of bots a user is trained to trust is going up, not down, and every one of them is a mask an attacker can wear. The same week as the $6.3 billion Binance breach, attackers also swapped a vendor’s monitoring script on Polymarket’s site for a drainer and swept about $2.7 million from roughly 710 wallets before the platform pledged refunds. The lesson threading through all of it is the same: in a market where trust is the real asset, trust is also the attack surface. The safest reflex you can build is to distrust the helpful bot, the urgent badge, and the pinned announcement by default, and to verify everything that matters somewhere the attacker cannot reach.

Frequently Asked Questions

What is the fake Telegram Safeguard bot scam?

It is a phishing campaign in which a bot, often named something close to OfficiaISafeguardBot, poses as a human-verification step inside a Telegram group promoted by a cloned founder account on X. The bot tells you to copy a code, press Win and R, and run it, which installs malware that steals your wallet files, browser sessions, and seed phrases. No legitimate Telegram group verifies members by asking them to run code.

Should I verify myself with a bot to join a crypto Telegram group?

No. Real Telegram groups do not gate a public chat behind a bot that makes you run commands or connect a wallet, and Discord verification never requires you to open PowerShell. Any verification that asks you to execute code, paste a clipboard string, or reveal a recovery phrase is the attack itself, so leave the group and report the bot.

Are Telegram trading bots like Maestro and Banana Gun safe to use?

The genuine bots are widely used, but they concentrate risk because trading from a chat means handing a key to software, and in September 2024 users of the real Banana Gun bot were drained of about $1.9 million in an incident tied to isolated accounts. The bigger danger is clone bots that copy a popular bot’s name and avatar and ask you to import a wallet by pasting a seed phrase. Only ever use a small, disposable hot wallet for bot trading and never import a savings wallet.

How do crypto Discord servers get hacked to post fake mints?

Attackers phish a moderator’s login, steal an admin’s browser session, or hijack a bot token or webhook, then post a fake mint or airdrop link in the official announcement channel. Because the message comes from the real server, members trust it and connect their wallets before the team can revert it. Always confirm a mint on the project’s official website reached independently, not through a link posted in chat.

What should I do if I ran a command from a crypto bot or entered my seed phrase?

Assume the device and every wallet on it are compromised. Move any remaining funds to a brand-new wallet created on a clean device, revoke token approvals at revoke.cash, rotate exchange and email passwords with 2FA from a different machine, and wipe or reset the infected computer. If you pasted a seed phrase, that wallet can never be considered safe again, so abandon it entirely.

Anneke de Vries covers security and exploits for HOGE Wire.