Bybit warned users on Friday to update Telegram on Android after a flaw allowed code to be triggered by a single chat message. The exchange said the risk was not limited to Telegram itself, noting that a compromised phone could expose other apps on the same device, including exchange and wallet software.
The alert followed a short sequence of events this month: Telegram enabled bot “widgets” on November 9, and security firm V12 then demonstrated that a bot message could remotely open the Calculator app on an Android phone. Telegram later said the issue had been fixed and the patch distributed to users on November 11.
How the flaw emerged
Telegram introduced widgets for bots on November 9, adding small in-chat applications that can run inside a message. Two days later, V12 published a video showing a bot message causing an Android device to launch its Calculator app without the user doing so.
That behavior is consistent with remote code execution, or RCE, in which an external party can make a device run commands it should not. In the source report, the issue was described in broad terms as turning an ordinary Telegram message into a possible entry point for code execution on Android.
Why crypto users were singled out
Bybit’s warning focused on the wider consequences of a compromised phone. If malware or unauthorized commands can run through Telegram, the exposure may extend to exchange apps, wallet apps and any other sensitive software installed on the same device.
The concern is heightened by Telegram’s deeper push into payments. The widgets support payments in Gram, the TON blockchain’s currency, through Telegram’s self-custody wallet. In a self-custody setup, transfers cannot be reversed by a company once sent. The source article also cited Pavel Durov as saying that more than 1 million of those wallets went live within 48 hours.
Account access concerns beyond two-factor authentication
The report also pointed to another risk raised by dev.ua: code running with Telegram’s level of access could potentially reach the data that keeps an account logged in. If that is the case, an attacker may not need a password reset or a fresh login to abuse an existing session.
That matters because two-factor authentication does not protect a session that is already open. For users who keep messaging, wallet and exchange apps active on the same phone, session exposure could become a practical security problem even after standard account protections are enabled.
Telegram’s response and the broader backdrop
Telegram said on November 11 that the Android issue had already been fixed and that the update had been deployed to all users earlier that day. The company has not said, according to the source report, whether iPhone or desktop versions were affected.
The article described this as Telegram’s second Android code-execution issue within a month, following a voice-call bug disclosed by NebuSec. It also linked the warning to a broader industry memory of device compromise: Bybit itself lost about $1.5 billion in February 2025 after hackers that the FBI tied to North Korea compromised a developer’s computer at its wallet provider.
What users have been told to do next
Bybit urged users to stay away from unknown bots, chats and links, and to rely only on its verified channels. The exchange’s immediate message was straightforward: Android users should update Telegram now.
One open question is whether the attack surface could grow further. The source article said widgets are also planned for group chats, although no launch date has been announced. Until Telegram provides more detail, the clearest confirmed next step remains keeping the Android app updated and avoiding untrusted bot interactions.
Source: beincrypto.com