Then they are welcome to prove it. Telegram runs a cracking contest with a prize of $300,000 for anyone who can actually decipher messages, alongside an ongoing Bug Bounty Program. The offer has stood for years.
Why the contest is the right answer
Claims about breaking encryption are cheap, and demonstrating one is not. A public contest with a defined prize converts the claim into a test with a result, which is the only form such a claim can usefully take. Somebody who can do what they say has a straightforward path to a considerable sum; somebody who cannot has an explanation for why they are not entering.
Reporting something real
- Write to security@telegram.org with the details.
- Include what you found, how to reproduce it, and which version and platform you tested.
- Submissions that result in a change of code or configuration are rewarded.
The Bug Bounty page carries the current terms and scope, and is worth reading before submitting.
What to be sceptical of
- A claim with no reproduction, no version and no specifics.
- A "decryption service" offering to read someone else's messages for a fee. These are scams without exception, and the product being sold is your payment.
- Anything requiring your login code or your two-step password, which are ways of taking your account rather than breaking anything.
Account compromise in the real world is nearly always someone obtaining a login code, not cryptography failing. Two-step verification under Settings, Privacy and Security closes that route.
Updated