Crypto exchange Bybit told users on Friday to update Telegram on Android now. The warning follows a bug that let a single chat message run code on Android phones.
The risk reaches beyond Telegram. “A compromised device could also put other apps at risk,” Bybit said. Exchange and wallet apps often share a phone with Telegram.
What did the Telegram bug do?
On November 9, Telegram let bots send “widgets,” small apps inside a chat message, according to tbreak.
Two days later, security firm V12 posted a video in which a bot message opened an Android phone’s Calculator app on its own. That demonstrates remote code execution (RCE): an outsider making a device run commands it should not.
V12 has not published how the attack works, and no independent party has confirmed it, Kod.ru reported.
Is the Bug Fixed?
Telegram says yes. “This issue in Telegram for Android was fixed yesterday, and the fix was deployed to all users earlier today,” it posted on November 11.
dev.ua found no evidence of real attacks.
Why Does it Matter for Crypto Users?
The widgets carry payments in Gram, the TON blockchain’s currency, formerly Toncoin, through Telegram’s self-custody wallet. Self-custody means no company can reverse a transfer. Durov said over 1 million of those wallets went live within 48 hours, TokenPost reported.
dev.ua also noted that code running with Telegram’s access could, in theory, reach the data keeping an account logged in. Two-factor authentication does not protect sessions already open.
This is Telegram’s second Android code-execution flaw in a month, after a voice-call bug disclosed by NebuSec. Bybit itself lost about $1.5 billion in February 2025 after hackers, whom the FBI tied to North Korea, compromised a developer’s computer at its wallet provider.
What Should Users Watch Next?
Bybit urged users to avoid unknown bots, chats and links, and to trust only its verified channels.
Telegram has not said whether iPhone or desktop users were affected. Widgets are also set to reach group chats, with no date announced.
