Telegram Android Flaw Sparks Bybit Security Warning for Crypto Users
Crypto exchange Bybit warned users on Friday to update Telegram on Android following a bug that allowed a single chat message to execute code on devices.
The vulnerability, discovered on November 9, allowed bots to send "widgets"—small apps within chat messages. Two days later, security firm V12 demonstrated how a bot message could remotely open an Android phone's Calculator app, showcasing a remote code execution (RCE) capability. While V12 hasn't published the attack method details and no independent confirmation exists, the potential risks are significant.
Patch Deployed
Telegram claims the issue has been fixed. "This issue in Telegram for Android was fixed yesterday, and the fix was deployed to all users earlier today," the company stated on November 11. Security researchers at dev.ua found no evidence of actual attacks exploiting this vulnerability.
A compromised device could also put other apps at risk
Crypto Wallet Concerns
The bug poses particular risks for crypto users as Telegram widgets handle payments in Gram (formerly Toncoin) through the TON blockchain's self-custody wallet. Pavel Durov revealed over 1 million such wallets were activated within 48 hours. Code running with Telegram's permissions could potentially access logged-in account data, even with two-factor authentication protecting sessions.
This marks Telegram's second Android code-execution flaw in a month, following a voice-call bug disclosed by NebuSec. Bybit itself experienced a $1.5 billion breach in February 2025 after hackers compromised a developer's computer at its wallet provider.
User Recommendations
Bybit urged users to avoid unknown bots, chats, and links, trusting only verified channels. Telegram hasn't specified whether iPhone or desktop users were affected, though widgets are planned for group chats with no timeline announced.
Related
