Telegram Hacked: What to Do in 7 Steps (2026 Lockdown Guide)

what you will end up with

Twenty to forty minutes if your phone is in your hand right now and your email is open in another tab. That is all this takes. By the end, you will have terminated every unauthorized session, locked the account with a cloud password that SMS interception cannot bypass, confirmed your recovery email belongs to you, audited every channel and group you run for damage, warned contacts about impersonation attempts that are probably already in progress, filed a support record with Telegram, and put a monitoring habit in place so you catch a second intrusion before it does real harm.

This guide is about what to do when your telegram is hacked. Not how to prevent it next time. Prevention is a different post. If something is wrong right now, start at step one and do not skip forward.

before you start

You need the phone number your Telegram account is registered to, working SMS delivery to that number, Telegram version 9.0 or later on a device you control, and a real email address open in a second tab. If your SIM was ported or cloned as part of the attack, call your carrier before you open Telegram. Everything below assumes your SIM is still physically yours. If you are not sure, dial your own number from a landline and see if it rings. Check your app version now:

Settings > About Telegram
Build: 9.x.x or higher required (10.x recommended)

Versions below 9.0 have submission bugs in the Two-Step Verification screen. Update first, then come back.

the step-by-step

1. Terminate every active session right now.

Open Telegram and go to Settings > Privacy and Security > Active Sessions. The screen shows every device and browser currently signed in as you, with device type and approximate location. Scan for anything unfamiliar: an Android session in a country you have not visited, a Telegram Web tab you did not open, a desktop client on hardware you do not own. Tap each unfamiliar session and hit Terminate, or use the red “Terminate All Other Sessions” button at the bottom to kill everything except your current device. Do this before anything else. An attacker’s first move after gaining access is to establish a persistent session. Killing sessions cuts that thread.

2. Set or change your cloud password.

Once sessions are revoked, go to Settings > Privacy and Security > Two-Step Verification. If it shows “Set Password,” the account never had a second factor. That is how it was taken over. Someone intercepted the SMS OTP (via SIM swap or SS7 interception) and walked straight in. Set the cloud password now. If the screen shows “Change Password” and you never configured 2FA yourself, the attacker set one during their session to lock you out. Use “Forgot Password” immediately from that screen and move fast. Telegram’s SRP-based 2FA protocol means the password you set is never transmitted to Telegram’s servers in cleartext, which is why this layer is meaningfully stronger than SMS alone. The cloud password is what makes telegram hacked scenarios recoverable instead of permanent.

3. Change your recovery email to one you control.

After setting the cloud password, check which email address is attached to your account. Back in Two-Step Verification settings. An attacker who had time in your account may have swapped the recovery email to one they own. If the account ever needs a password reset, the reset code goes to that address. If they own it, they win the recovery race no matter what you do next. Change the email now. Enter an address you can open immediately, verify the six-digit code Telegram sends, and confirm. Telegram marks the email field as optional. Treat it as mandatory. EFF’s account security guidance consistently flags recovery email ownership as the deciding factor in whether account takeovers become permanent. This is the step most people skip when figuring out what to do when telegram is hacked.

4. Audit every channel and group you administer.

The attacker could see which channels and groups you admin from inside your account. Large Telegram channels are commercially valuable for spam drops, scam promotions, and crypto pump-and-dump campaigns. High-trust groups are useful for impersonation. Check each channel where you have admin rights. Look at the post history for messages you did not write, and delete them. Check the admin list for names you do not recognize, and remove them. Check the invite links too: if any link was regenerated or a new one was created during the compromise window, revoke all links and generate fresh ones with an expiry date. If the channel is large, assume the attacker screenshotted your member list. Note it for the next step.

5. Notify your contacts about impersonation attempts.

Attackers with account access routinely message the victim’s contacts while impersonating them. Common scripts: distress messages asking for USDT or other crypto, investment opportunities, “I changed my number, add me here,” or links to phishing pages dressed up as legitimate services. Send an alert from a verified secondary channel or a different messaging platform. Be clear that your Telegram was compromised during a specific window and that messages from your account during that period should not be trusted. Specific timeframe matters. People who received a suspicious message and acted on it need to know. You will also find out, from their replies, how much damage was already done before you started the lockdown.

6. File a Telegram support ticket.

Telegram support does not move fast. Response times for account compromise cases typically run one to four weeks. File the ticket anyway. Go to Telegram’s official support page and submit under the account compromise category. Include the date and time you detected the breach, the approximate timeframe of unauthorized access, any sessions you terminated and their locations, and whether the recovery email was changed. The ticket is documentation, not rescue. If you need to escalate later, or if attacker activity triggers an automated ban on your account, a prior support record with a clear timeline is the evidence you want. Do not expect a fast reply. The steps above are the actual lockdown.

7. Set up monitoring to catch a second attempt.

After a compromise, you are a known target. The same actor may try again, or sell your credentials to someone else. Set a repeating reminder to check Active Sessions weekly for the first month, then monthly. Enable login notifications: Settings > Notifications, then look for account authorization alerts, which push an in-app notification when a new device signs in. Cross-reference any new session against the IP and device type you normally use. Access Now’s digital security helpdesk, which assists high-risk users globally, has documented cases where the same accounts were retargeted within days of recovery. The monitoring habit is not paranoia. It is the only way to close the gap between a re-intrusion and your detection of it.

# weekly session check, paste into notes as a recurring prompt
1. Settings > Privacy and Security > Active Sessions
2. Terminate anything not recognized or not used in past 7 days
3. Confirm recovery email in Two-Step Verification is still correct
4. Check channel admin lists if you run a channel with >500 members

what can go wrong

The attacker already changed the cloud password and you are locked out. This is the worst entry point. If you trigger “Forgot Password” and the recovery email belongs to the attacker, the reset code goes to them and they win the race. Your path here is Telegram support escalation combined with carrier cooperation. Telegram will sometimes restore an account to the original registered phone number owner if you can demonstrate prior access and the SIM is still yours. There is no timeline guarantee. telegram-account-recovery-challenge/" target="_blank" rel="noopener">Citizen Lab’s research on targeted account recovery is blunt about this: attackers who know the recovery email is the pivot point change it first, before they do anything else with the account. If you have not set a recovery email yet, do it before you need it.

The attacker added themselves as channel admin before you revoked sessions. Terminating sessions does not strip admin rights already granted. Check every channel’s admin list manually. If the attacker was given “Add Admins” permission, go three levels deep: remove the attacker, check whether they added additional accounts, then check if those accounts added anyone else. A well-prepared attacker builds redundant admin access so that losing the original session does not end their control.

Your phone number was ported as part of the attack. SIM swap is often the setup move before a Telegram takeover. If you cannot receive SMS on your registered number, start with your carrier fraud line, not with Telegram. Get the port reversed. Once your number is confirmed active on your SIM, the Telegram recovery flow works normally. Attempting recovery without SIM control means every OTP the process sends goes to the attacker. The connection between your IP environment and your attack surface is relevant here too. The dedicated vs shared mobile IPs post covers why static carrier-assigned IPs make social engineering attacks against your number significantly harder.

The attacker harvested your contact list and message history. Once a session is active, an attacker can export contacts, read DM history, and map group memberships. You cannot recover that data privacy after the fact. What you can do is limit the follow-on damage: be transparent with contacts, rotate invite links for any groups you run, and assume that anyone your account DM’d during the compromise window has been targeted for phishing. If your account handled sensitive business conversations, brief the other parties so they know the context was exposed.

how this looks on managed hosting

When your Telegram session lives on a telegramvault cloud phone, the process of knowing what to do when telegram is hacked is structurally identical, but the attack surface is narrower. The session runs on a dedicated Android handset in our Singapore farm, tied to a static SingTel, M1, StarHub, or Vivifi SIM. That static mobile carrier IP means any new session appearing from a foreign residential block or a datacenter range is immediately visible as anomalous in the Active Sessions list. You run the lockdown by opening the STF browser session and working through the steps above inside the remote Telegram interface. Same tap flow as on a physical phone. The cloud password lives in Telegram’s own servers, not on the handset, so hardware replacement does not reset it. The recovery email verification works identically: the code arrives in your inbox and you enter it via the remote session. If you cannot reach the STF interface during a crisis, contact the telegramvault team directly to confirm whether the session itself has been accessed. For accounts on the telegramvault waitlist, this escalation path is covered during onboarding.

recovery if you mess up

It comes down to one question: do you still control the SIM your account is registered to?

If yes: request a fresh OTP on the Telegram login screen using your phone number. Even if the attacker set a cloud password, the “Forgot Password” path on the login screen is available as long as you control the SIM. That path emails you a reset link. The link expires in about one hour. Act fast. After resetting, set a new cloud password and verify a fresh recovery email before doing anything else.

If no: call your carrier first. Report the fraudulent port and get the SIM restored to your control. This adds days to the recovery window depending on your carrier’s fraud team. Once your number is back, proceed as above.

If both the SIM and the recovery email are compromised: Telegram support is your only path, and response times are weeks, not hours. During that window, post a public notice in any channel you run, file repeat support tickets with additional evidence (screenshots of the legitimate session history, device fingerprint details, any login confirmation emails from earlier legitimate sessions), and accept that recovery will be slow. The more documented evidence you accumulate, the better your support case.

Telegram does not restore deleted message history or channel memberships after account deletion and re-registration. If you reach the point of deleting and re-registering the number, that content is gone. Factor that into how long you are willing to wait for support before going that route.

Checking your active sessions as a regular habit. The why Telegram bans accounts post covers something most people miss: Telegram’s automated systems also watch session geography. An account that suddenly shows sessions across three different continents will catch Telegram’s enforcement attention before it catches yours. Regular session audits catch both attacker activity and the kind of session spread that triggers automated restrictions. The same audit that protects you from takeover also keeps Telegram’s spam detection from misreading your account as compromised infrastructure.

Understanding the IP your session originates from. Knowing what to do when telegram is hacked is reactive. Knowing why some accounts are targeted first is preventive. Shared residential pools and datacenter IPs are both higher-risk origination points because they carry association with known-bad traffic. A static mobile carrier IP from a real SIM is a different risk profile. The dedicated vs shared mobile IPs post walks through the practical tradeoffs, including when a dedicated line actually changes your exposure and when it does not.

Running multiple numbers without cross-contamination. If one account is compromised and you operate several, the attacker may have seen references to your other numbers in the DM history of the compromised account. Isolated sessions on separate hosting environments limit how much a single compromise reveals. BYO number Telegram hosting covers how to structure multiple numbers on separate hosted sessions so that one breach does not become an entry point for the others.

What Telegram’s support actually looks like in practice. Filing a ticket matters even when response times are slow. If your account is later subject to a ban related to attacker activity during the compromise window, a prior support record demonstrating the account was hacked is useful context. Keep timestamps, screenshots of unauthorized sessions, and any login confirmation emails that arrived during the breach period. That documentation matters most if you ever need to dispute an enforcement action that originated from the attacker’s use of your account.

final word

If your telegram was hacked, the clock started when the attacker got in, not when you noticed. Sessions that stay active after you discover a breach continue to expose data and damage reputation while you are reading guides. Get into Active Sessions first, kill everything unfamiliar, then work the remaining six steps in sequence. This playbook reflects what actually stops the bleeding across dozens of customer account incidents, across carriers and regions from Tehran to Manila to Lagos. Telegram does not make recovery simple, but the tools are all there if you move fast enough.