News Heat Trend
Project Overview
Telegram Messenger is a globally accessible freemium, cloud-based and centralized instant messaging (IM) service. The application also provides optional end-to-end encrypted chats (popularly known as "secret chats") and video calling, VoIP, file sharing and several other features.Telegram was launched in 2013 by the brothers Nikolai and Pavel Durov. Previously, the pair founded the Russian social network VK.
AlphaTON Capital Plans to Raise $43 Million to Expand AI Computing Infrastructure
According to The Block, AlphaTON Capital has announced plans to raise $43 million through a strategic partnership with Vertical Data Inc. to expand its AI compute infrastructure; the transaction is expected to close in Q2 2026. AlphaTON CEO Brittany Kaiser stated that the funding will be used to deploy additional NVIDIA B300 GPUs, with the core objective of advancing the convergence of AI, digital assets, and confidential computing—and scaling up the platform’s overall compute capacity. On the business front, AlphaTON not only holds a substantial amount of TON tokens as corporate treasury assets but also actively participates in building infrastructure for the Telegram and TON ecosystems, with key investment focus areas including Cocoon, Telegram’s decentralized AI platform. Background-wise, AlphaTON was formed through the restructuring and transformation of former biotech public company Portage Biotech Inc., which had previously focused on cancer therapy research; the company completed the spin-off of its cancer therapy subsidiary in February this year.
AlphaTON and Vertical Data Announce $43 Million AI Infrastructure and Financing Partnership
AlphaTON Capital (NASDAQ: ATON) announced a strategic AI hardware and financing agreement with Vertical Data Inc., with a total transaction value of approximately $43 million, expected to close in Q2 2026. The agreement centers on deploying high-performance GPU clusters powered by NVIDIA’s B300 architecture. Financing will be provided through Vertical Data’s GPUfinancing.com platform via an asset-backed, non-recourse structure and includes managed infrastructure services. This expansion will support AlphaTON’s business initiatives with partners including Telegram, Gamee, Animoca Brands, and Midnight Blockchain.
Telegram Founder Durov Listed as "Terrorist" by Russia for Refusing to Comply with Mass Surveillance
Telegram founder and CEO Pavel Durov (@durov) revealed in a post that the Russian government has designated him as a "terrorist" because he refused to comply with Russian demands to implement mass surveillance and content censorship on Telegram. Under relevant Russian laws, Durov is prohibited from "publishing any information on the internet." Durov responded to this by stating: "Russian officials obviously fail to understand who can actually kick whom off the internet."
Australian regulators filed a lawsuit against Telegram, alleging it failed to remove content supporting terrorism.
据 Cointelegraph 报道，澳大利亚互联网监管机构对 Telegram 提起法律诉讼，指控其未能移除支持恐怖主义的内容。
Russia Initiates Criminal Prosecution Against Durov, State Duma Recommends Citizens Stop Using Telegram Ecosystem Financial Services
Russian State Duma Committee on Information Policy Deputy Chairman Sventsov subsequently suggested that Russian citizens suspend all financial operations within the Telegram ecosystem, including paid subscriptions and purchasing TON/Gram tokens, and wait for official statements from Roskomnadzor and FSB before making further decisions.
Telegram Founder Pavel Durov Questioned by French Investigators for Over Six Hours
According to Cointelegraph, Telegram founder Pavel Durov was questioned by French investigators for more than six hours due to an ongoing criminal investigation. His lawyer stated that authorities do not yet possess evidence supporting the relevant charges.
US Department of Justice Seizes Huione Account Allegedly Laundering Billions of Dollars
: The US Department of Justice announced the seizure of an account that provided backend infrastructure for a subsidiary of Cambodia's Huione Group. Prosecutors stated that the account helped operate the Telegram marketplace Huione Guarantee, which matched stolen data, money laundering services, and tools for Southeast Asian scam operations.Additionally, on the same day, FinCEN took action to extend the existing Huione ban to its successor entity, H-Pay Service PLC, to prevent the group from circumventing US restrictions. According to court documents, the custody service operated by the account also assisted criminals, including money launderers, in cryptocurrency transactions. The case is currently being jointly investigated by the FBI's San Francisco office and IRS Criminal Investigation. (decrypt)
Polymarket Plans to Require Traders to Complete KYC Identity Verification Amid Growing Sanctions and Legal Risks
: Prediction market Polymarket is facing increased pressure from regulatory and sanctions compliance. It is reported that the platform is pushing traders to undergo identity verification (KYC) to mitigate potential legal and compliance risks.Although Polymarket's betting platform rules do not permit such activities in certain regions, some users have still been participating in market trading through automated trading bots and other methods, forming gray usage pathways in areas such as Russia. Some developers have even utilized tools like Telegram to organize trading traffic and expand their user base. As the platform scales and regulatory scrutiny intensifies, Polymarket is being forced to seek a balance between the decentralized prediction market model and compliance requirements to address potential sanctions and legal risks. (The Information)
value of 73 BTC, worth $4.6 million, originally came from the Whirlpool coin mixer, with some funds bridged to Ethereum and deposited through a phishing Tornado Cash interface
Odaily News: According to on-chain detective Specter's monitoring, the victim claimed that due to a Coldcard hack, funds were transferred from Bitcoin to Ethereum. However, on-chain data shows that the 73 BTC ($4.6 million) originally came from the Whirlpool coin mixer two weeks ago, with some of it bridged to Ethereum and subsequently deposited through a phishing Tornado Cash interface. Two coin mixers were used during the fund transfer process. The individual was also found to have appeared in Telegram groups involving private key searches and brute-force attacks. On-chain detective Specter stated that the victim may be a threat actor, and their funds may have been stolen by another threat actor.
Due to sanctions, NoOnes will gradually wind down its operations
Odaily News: Peer-to-peer cryptocurrency trading platform NoOnes announced that it will begin gradually winding down operations after running for over three years. The company stated that it had been continuously seeking to resolve and lift the sanctions imposed on NoOnes, but ultimately failed. The sanctions caused the platform to lose key partners, and blockchain monitoring firms also flagged transactions associated with NoOnes as high-risk, making it increasingly difficult for the platform to continue normal operations. According to the plan, the business contraction began on August 17, and the P2P marketplace will close at 23:59 UTC on August 21. Services such as Swap, NoOnes Visa, fiat withdrawals, the gift card store, and the Bitcoin Lightning Network will also be discontinued progressively. After that, the platform will only support withdrawals, and users will still be able to log in, view balances, and withdraw remaining assets. The company advises users to complete asset withdrawals as soon as possible, no later than August 23. Previously, on January 26, 2025, NoOnes revealed that the platform had suffered a major security breach earlier that month, resulting in losses of approximately $8 million in crypto assets. CEO Ray Youssef confirmed the news after on-chain detective ZachXBT disclosed the hacking incident on his Telegram channel.
Coldcard security incident loses 1,359.882 BTC, attacker address receives 10% coin-mixing offer
Odaily News: In the Coldcard security incident involving hardware wallet company Coinkite, the amount of stolen bitcoin has risen to approximately 1,359.882 BTC. According to statistics from the Coldcard Sweep Watch dashboard, most of the identified bitcoin remains in a small number of addresses controlled by the attacker. On August 1, one of the attacker's holding addresses received a transaction containing an OP_RETURN message. The message publicly offered a 10% fee for "washing" bitcoin, KYC assistance, and withdrawal services for stolen funds, along with a Telegram contact. Coinkite has released an urgent firmware update to fix the weak random number generation issue that caused the original vulnerability. The company stated that the new firmware only protects wallets created in the future and cannot fix seeds already generated on affected versions. Some users have reported that after installing the update, their devices remain stuck on an error screen, fail to boot, or appear bricked. This mainly affects Mk4 and Q devices, though some Mk3 users have also reported similar issues. As of August 2, Coinkite has not publicly confirmed a widespread firmware defect.
Dragonfly Partner: Meme Coin Trading is Retail-Driven, Should Not Exhibit Weekend Lull Typical of Professional Markets
Odaily Odaily News: Dragonfly partner Haseeb posted on X platform, responding to doubts about the long-term stability of Pump.fun's revenue curve. He believes this phenomenon is not abnormal and, from a macro perspective, closely resembles the trend of overall crypto spot trading volume.Haseeb stated that some users suspect data anomalies because daily trading volume appears too stable, lacking a weekend dip. However, he argues this perspective overlooks the participant structure of the Meme coin market. Since Meme coin trading is primarily driven by retail investors, it does not experience a significant decline in trading volume on weekends, unlike markets dominated by professional traders and hedge funds such as Hyperliquid.Haseeb noted that users can verify this by examining Pump.fun's pre-issuance revenue data, which previously showed similar stability and does not indicate any irregularities. Additionally, he mentioned that trading terminals and Telegram bots have relatively high trading volumes, so their revenue is not necessarily highly correlated with Pump.fun itself. Currently, the revenue curve of the largest trading terminal, Axiom, closely resembles that of Pump.fun.
Court documents allege Jane Street used insider information from Terraform to short UST, profiting $134 million
According to recently unsealed court documents, Jane Street is alleged to have obtained insider information from Terraform Labs via a private Telegram group named "Bryce's Secret."The documents claim that Jane Street subsequently sold approximately $192 million worth of UST when it was near its peg price, and profited around $134 million by shorting UST during the collapse of TerraUSD and the evaporation of roughly $40 billion in market value from the Terra ecosystem. (CoinDesk)
Terraform Liquidator Accuses Jane Street of Obtaining Inside Information via Telegram Private Group
According to CoinDesk, newly unsealed court documents allege that Jane Street, a major Wall Street quantitative trading firm, obtained non-public internal information from Terraform Labs via a private Telegram group named “Bryce’s Secret” prior to the 2022 Terra collapse. The firm is accused of selling approximately $192 million worth of UST in advance and establishing short positions, thereby profiting roughly $134 million amid the collapse of the Terra ecosystem—valued at approximately $40 billion. The complaint states that on May 7, 2022—just nine minutes after Terraform withdrew $150 million in liquidity from the Curve pool—Jane Street sold around $85 million worth of UST on Curve. The associated wallet was subsequently suspected of being a key address contributing to UST’s de-pegging. However, Jane Street denies these allegations, calling the lawsuit “baseless,” and states it will vigorously defend itself.
value of 73 BTC, worth $4.6 million, originally came from the Whirlpool coin mixer, with some funds bridged to Ethereum and deposited through a phishing Tornado Cash interface
Odaily News: According to on-chain detective Specter's monitoring, the victim claimed that due to a Coldcard hack, funds were transferred from Bitcoin to Ethereum. However, on-chain data shows that the 73 BTC ($4.6 million) originally came from the Whirlpool coin mixer two weeks ago, with some of it bridged to Ethereum and subsequently deposited through a phishing Tornado Cash interface. Two coin mixers were used during the fund transfer process. The individual was also found to have appeared in Telegram groups involving private key searches and brute-force attacks. On-chain detective Specter stated that the victim may be a threat actor, and their funds may have been stolen by another threat actor.
Due to sanctions, NoOnes will gradually wind down its operations
Odaily News: Peer-to-peer cryptocurrency trading platform NoOnes announced that it will begin gradually winding down operations after running for over three years. The company stated that it had been continuously seeking to resolve and lift the sanctions imposed on NoOnes, but ultimately failed. The sanctions caused the platform to lose key partners, and blockchain monitoring firms also flagged transactions associated with NoOnes as high-risk, making it increasingly difficult for the platform to continue normal operations. According to the plan, the business contraction began on August 17, and the P2P marketplace will close at 23:59 UTC on August 21. Services such as Swap, NoOnes Visa, fiat withdrawals, the gift card store, and the Bitcoin Lightning Network will also be discontinued progressively. After that, the platform will only support withdrawals, and users will still be able to log in, view balances, and withdraw remaining assets. The company advises users to complete asset withdrawals as soon as possible, no later than August 23. Previously, on January 26, 2025, NoOnes revealed that the platform had suffered a major security breach earlier that month, resulting in losses of approximately $8 million in crypto assets. CEO Ray Youssef confirmed the news after on-chain detective ZachXBT disclosed the hacking incident on his Telegram channel.
Can steal mnemonic phrases and private keys, malicious COLDCARD seed recovery tool exposed as containing backdoor
: Bitcoin News posted on the X platform stating that a security analysis revealed a repository distributed on GitHub, disguised as a proof-of-concept tool for a COLDCARD random number generator, is malicious in nature. The software claims to be a research tool that reproduces a flawed wallet random number generator to help recover Bitcoin wallets created with vulnerable seeds. According to the report, the tool contains a remote code execution backdoor that downloads an information-stealing program capable of collecting wallet mnemonic phrases, private keys, browser passwords, SSH keys, and other credentials, exfiltrating the data via Telegram while installing persistent malware on Windows, macOS, and Linux. Researchers stated that any user who has executed the code should treat the affected device as fully compromised, rotate credentials, transfer crypto assets to a newly generated wallet, and report the repository. The analysis also warned against running proof-of-concept code for vulnerabilities on devices containing wallets or sensitive data without independent verification.
Coldcard Hacker Wallet Becomes "Blockchain Message Wall," Holding Over $36 Million in Stolen BTC
According to CoinDesk, since the Coldcard hardware wallet vulnerability incident erupted on July 30, the wallet address associated with the hackers (bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r) has received multiple Bitcoin transfers accompanied by text messages. The wallet currently holds approximately $36 million in stolen assets, and confirmed losses from this incident have exceeded $100 million. The aforementioned information was written on-chain via Bitcoin's OP_RETURN function and permanently stored on the blockchain. The content covers victims' pleas for compensation (such as "You stole, please return some," "Return 80% of my 5 BTC"), solicitations for money laundering services ("I launder BTC, taking a 10% commission," with Telegram contact information included), and even fundraising requests completely unrelated to the incident, varying in nature.
Telegram Says It Was Hit by "Takedown Extortion" Attack: Apple App Store Briefly Removed App Due to User-Implanted Violative Content
Telegram founder and CEO Pavel Durov stated that Telegram was briefly removed from the App Store by Apple recently, after a user implanted illegal pornographic content in a public group. The app was restored within hours.Durov said the attacker exploited a technical vulnerability to insert AI-modified illegal content into old messages within active groups, hiding the content by editing historical messages, making it difficult for regular group members to detect and report in time. This type of attack constitutes "takedown extortion," where attackers use automated accounts to implant violative content in public groups and report it to platforms like Apple, attempting to force group administrators to pay a ransom, or else exploit platform rules to get the community banned.Durov added that Telegram continuously combats illegal content through mechanisms such as user reports, AI filtering, and content hashing. This incident is not a systemic issue with the platform, but rather a targeted attack exploiting rule loopholes. He also warned that Apple's removal of the app without prior contact with Telegram could pose a risk to all mobile applications offering user-generated content (UGC), and platform developers need to strengthen their defenses against malicious reporting and "takedown attacks."
Coldcard security incident loses 1,359.882 BTC, attacker address receives 10% coin-mixing offer
Odaily News: In the Coldcard security incident involving hardware wallet company Coinkite, the amount of stolen bitcoin has risen to approximately 1,359.882 BTC. According to statistics from the Coldcard Sweep Watch dashboard, most of the identified bitcoin remains in a small number of addresses controlled by the attacker. On August 1, one of the attacker's holding addresses received a transaction containing an OP_RETURN message. The message publicly offered a 10% fee for "washing" bitcoin, KYC assistance, and withdrawal services for stolen funds, along with a Telegram contact. Coinkite has released an urgent firmware update to fix the weak random number generation issue that caused the original vulnerability. The company stated that the new firmware only protects wallets created in the future and cannot fix seeds already generated on affected versions. Some users have reported that after installing the update, their devices remain stuck on an error screen, fail to boot, or appear bricked. This mainly affects Mk4 and Q devices, though some Mk3 users have also reported similar issues. As of August 2, Coinkite has not publicly confirmed a widespread firmware defect.
Telegram 已向 ICANN 申请“.gram”域名，拟支持用户创建个人网站
Telegram 创始人 Pavel Durov 表示，Telegram 已向 ICANN 申请“.gram”域名。若获批准，Telegram 用户可注册类似 yourname.gram 的域名，并通过提示词创建由 Telegram 托管的交互式网站。
Due to sanctions, NoOnes will gradually wind down its operations
Odaily News: Peer-to-peer cryptocurrency trading platform NoOnes announced that it will begin gradually winding down operations after running for over three years. The company stated that it had been continuously seeking to resolve and lift the sanctions imposed on NoOnes, but ultimately failed. The sanctions caused the platform to lose key partners, and blockchain monitoring firms also flagged transactions associated with NoOnes as high-risk, making it increasingly difficult for the platform to continue normal operations. According to the plan, the business contraction began on August 17, and the P2P marketplace will close at 23:59 UTC on August 21. Services such as Swap, NoOnes Visa, fiat withdrawals, the gift card store, and the Bitcoin Lightning Network will also be discontinued progressively. After that, the platform will only support withdrawals, and users will still be able to log in, view balances, and withdraw remaining assets. The company advises users to complete asset withdrawals as soon as possible, no later than August 23. Previously, on January 26, 2025, NoOnes revealed that the platform had suffered a major security breach earlier that month, resulting in losses of approximately $8 million in crypto assets. CEO Ray Youssef confirmed the news after on-chain detective ZachXBT disclosed the hacking incident on his Telegram channel.
Telegram Says It Was Hit by "Takedown Extortion" Attack: Apple App Store Briefly Removed App Due to User-Implanted Violative Content
Telegram founder and CEO Pavel Durov stated that Telegram was briefly removed from the App Store by Apple recently, after a user implanted illegal pornographic content in a public group. The app was restored within hours.Durov said the attacker exploited a technical vulnerability to insert AI-modified illegal content into old messages within active groups, hiding the content by editing historical messages, making it difficult for regular group members to detect and report in time. This type of attack constitutes "takedown extortion," where attackers use automated accounts to implant violative content in public groups and report it to platforms like Apple, attempting to force group administrators to pay a ransom, or else exploit platform rules to get the community banned.Durov added that Telegram continuously combats illegal content through mechanisms such as user reports, AI filtering, and content hashing. This incident is not a systemic issue with the platform, but rather a targeted attack exploiting rule loopholes. He also warned that Apple's removal of the app without prior contact with Telegram could pose a risk to all mobile applications offering user-generated content (UGC), and platform developers need to strengthen their defenses against malicious reporting and "takedown attacks."
Telegram is back on the Apple App Store.
According to The Block, a Telegram spokesperson stated that Telegram has been relisted on the Apple App Store and will soon be open to all users again.
Coldcard security incident loses 1,359.882 BTC, attacker address receives 10% coin-mixing offer
Odaily News: In the Coldcard security incident involving hardware wallet company Coinkite, the amount of stolen bitcoin has risen to approximately 1,359.882 BTC. According to statistics from the Coldcard Sweep Watch dashboard, most of the identified bitcoin remains in a small number of addresses controlled by the attacker. On August 1, one of the attacker's holding addresses received a transaction containing an OP_RETURN message. The message publicly offered a 10% fee for "washing" bitcoin, KYC assistance, and withdrawal services for stolen funds, along with a Telegram contact. Coinkite has released an urgent firmware update to fix the weak random number generation issue that caused the original vulnerability. The company stated that the new firmware only protects wallets created in the future and cannot fix seeds already generated on affected versions. Some users have reported that after installing the update, their devices remain stuck on an error screen, fail to boot, or appear bricked. This mainly affects Mk4 and Q devices, though some Mk3 users have also reported similar issues. As of August 2, Coinkite has not publicly confirmed a widespread firmware defect.
South Korean police arrested over 5,200 drug suspects in the first half of the year and will strengthen crackdowns on online and foreign-related drug crimes in the second half.
According to Yonhap News Agency, data released by the National Investigation Headquarters of the Korean National Police Agency shows that during the concentrated crackdown campaign in the first half of this year (March to June), a total of 5,203 drug suspects were caught and 1,039 were detained, representing a year-on-year increase of 1.8% and 7.8% respectively. Among them, suspects involved in online drug transactions reached 2,178, accounting for 41.9% of the total number of suspects caught, an increase of 300 people compared to the same period last year; there were 848 foreign nationals involved in drug-related activities, an increase of 114 people year-on-year, with supply-related crimes accounting for up to 47.2%. During this period, the police also successfully extradited Philippine drug lord Park Wang-yeol and recovered criminal proceeds of 3.84 billion Korean won. In the second half of the year (August to December), the police will focus on strengthening crackdowns on drug sales channels on social platforms such as Telegram, and establish a 41-member special tracking team for virtual assets, while jointly strengthening efforts to crack down on drug crimes involving foreign personnel with international law enforcement agencies.
Related news
value of 73 BTC, worth $4.6 million, originally came from the Whirlpool coin mixer, with some funds bridged to Ethereum and deposited through a phishing Tornado Cash interface
Odaily News: According to on-chain detective Specter's monitoring, the victim claimed that due to a Coldcard hack, funds were transferred from Bitcoin to Ethereum. However, on-chain data shows that the 73 BTC ($4.6 million) originally came from the Whirlpool coin mixer two weeks ago, with some of it bridged to Ethereum and subsequently deposited through a phishing Tornado Cash interface. Two coin mixers were used during the fund transfer process. The individual was also found to have appeared in Telegram groups involving private key searches and brute-force attacks. On-chain detective Specter stated that the victim may be a threat actor, and their funds may have been stolen by another threat actor.
Telegram 已向 ICANN 申请“.gram”域名，拟支持用户创建个人网站
Telegram 创始人 Pavel Durov 表示，Telegram 已向 ICANN 申请“.gram”域名。若获批准，Telegram 用户可注册类似 yourname.gram 的域名，并通过提示词创建由 Telegram 托管的交互式网站。
Due to sanctions, NoOnes will gradually wind down its operations
Odaily News: Peer-to-peer cryptocurrency trading platform NoOnes announced that it will begin gradually winding down operations after running for over three years. The company stated that it had been continuously seeking to resolve and lift the sanctions imposed on NoOnes, but ultimately failed. The sanctions caused the platform to lose key partners, and blockchain monitoring firms also flagged transactions associated with NoOnes as high-risk, making it increasingly difficult for the platform to continue normal operations. According to the plan, the business contraction began on August 17, and the P2P marketplace will close at 23:59 UTC on August 21. Services such as Swap, NoOnes Visa, fiat withdrawals, the gift card store, and the Bitcoin Lightning Network will also be discontinued progressively. After that, the platform will only support withdrawals, and users will still be able to log in, view balances, and withdraw remaining assets. The company advises users to complete asset withdrawals as soon as possible, no later than August 23. Previously, on January 26, 2025, NoOnes revealed that the platform had suffered a major security breach earlier that month, resulting in losses of approximately $8 million in crypto assets. CEO Ray Youssef confirmed the news after on-chain detective ZachXBT disclosed the hacking incident on his Telegram channel.
Can steal mnemonic phrases and private keys, malicious COLDCARD seed recovery tool exposed as containing backdoor
: Bitcoin News posted on the X platform stating that a security analysis revealed a repository distributed on GitHub, disguised as a proof-of-concept tool for a COLDCARD random number generator, is malicious in nature. The software claims to be a research tool that reproduces a flawed wallet random number generator to help recover Bitcoin wallets created with vulnerable seeds. According to the report, the tool contains a remote code execution backdoor that downloads an information-stealing program capable of collecting wallet mnemonic phrases, private keys, browser passwords, SSH keys, and other credentials, exfiltrating the data via Telegram while installing persistent malware on Windows, macOS, and Linux. Researchers stated that any user who has executed the code should treat the affected device as fully compromised, rotate credentials, transfer crypto assets to a newly generated wallet, and report the repository. The analysis also warned against running proof-of-concept code for vulnerabilities on devices containing wallets or sensitive data without independent verification.
Coldcard Hacker Wallet Becomes "Blockchain Message Wall," Holding Over $36 Million in Stolen BTC
According to CoinDesk, since the Coldcard hardware wallet vulnerability incident erupted on July 30, the wallet address associated with the hackers (bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r) has received multiple Bitcoin transfers accompanied by text messages. The wallet currently holds approximately $36 million in stolen assets, and confirmed losses from this incident have exceeded $100 million. The aforementioned information was written on-chain via Bitcoin's OP_RETURN function and permanently stored on the blockchain. The content covers victims' pleas for compensation (such as "You stole, please return some," "Return 80% of my 5 BTC"), solicitations for money laundering services ("I launder BTC, taking a 10% commission," with Telegram contact information included), and even fundraising requests completely unrelated to the incident, varying in nature.
Telegram Says It Was Hit by "Takedown Extortion" Attack: Apple App Store Briefly Removed App Due to User-Implanted Violative Content
Telegram founder and CEO Pavel Durov stated that Telegram was briefly removed from the App Store by Apple recently, after a user implanted illegal pornographic content in a public group. The app was restored within hours.Durov said the attacker exploited a technical vulnerability to insert AI-modified illegal content into old messages within active groups, hiding the content by editing historical messages, making it difficult for regular group members to detect and report in time. This type of attack constitutes "takedown extortion," where attackers use automated accounts to implant violative content in public groups and report it to platforms like Apple, attempting to force group administrators to pay a ransom, or else exploit platform rules to get the community banned.Durov added that Telegram continuously combats illegal content through mechanisms such as user reports, AI filtering, and content hashing. This incident is not a systemic issue with the platform, but rather a targeted attack exploiting rule loopholes. He also warned that Apple's removal of the app without prior contact with Telegram could pose a risk to all mobile applications offering user-generated content (UGC), and platform developers need to strengthen their defenses against malicious reporting and "takedown attacks."