The short answer
- 1Telegram challenges anyone who claims to break its encryption to prove it in a public contest.
- 2Real flaws go to security@telegram.org under the bug bounty, in English, using the official template.
- 3Public disclosure before a fix forfeits the reward, and paid 'hacking tools' are scams.
In this article
"Prove it": the cracking contest
Telegram's FAQ answers people who claim its messages can be read with a challenge: anyone who can decipher Telegram messages is welcome to prove it in Telegram's cracking contest and win the prize it advertises ($300,000, according to the FAQ). The idea is that a security claim should be tested in public, not taken on trust. How the encryption is built is covered in Telegram encryption explained in plain words.
The bug bounty: if you actually find a flaw
Separately from the contest, Telegram runs a bug bounty. The main points from the official page:
| Item | What the official page says |
|---|---|
| In scope | Any Telegram-owned or operated app, web service, domain, server and protocol that handles or stores private user data |
| How to report | By email to security@telegram.org, written in English and following the template on the page. Telegram does not use third-party bounty platforms |
| Rewards | From $100 to $100,000 or more depending on severity; app-level issues sit at the lower end, protocol-level issues at the top |
| Not covered | Phishing and spam, clickjacking, missing cookie flags, denial of service, attacks that need physical access to the user's device, and mistakes by third-party developers |
| Conditions | Testing must not break any law, disrupt the service or affect other users; no attempts to physically access Telegram's equipment; issues disclosed publicly or to third parties before they are fixed are not eligible |
The last condition matters most: report privately and wait for the fix. Posting the flaw first forfeits the reward.
What this means for ordinary users
- "Telegram hacking tools" are scams. Someone with a real flaw has a legitimate buyer: Telegram's own bounty. Programs sold as "hack any account" or "read anyone's chats" are fake, or are malware aimed at you.
- "I can recover / open any account for a fee" is a scam. Flaws are reported and fixed, not rented out. People offering this want your money or your login code.
- A bug is not always a security flaw. Crashes, display errors and feature requests go to the regular bug report channel; see reporting a bug or suggesting a feature.
- Account problems go to support. Login trouble or a spam limit is not a vulnerability; see contacting Telegram support.
FAQ
How do I report a security vulnerability to Telegram?
Email security@telegram.org in English, following the template on Telegram's bug bounty page. Do not disclose it publicly before it is fixed.
How much does the Telegram bug bounty pay?
The official page lists rewards from $100 to $100,000 or more, depending on severity.
Are Telegram hacking tools real?
No. Tools sold to hack accounts or read chats are scams or malware. Real flaws are reported to Telegram's bounty.
Sources
At a glance
- 1Contest
Prove a decryption claim in public.
- 2Bounty
security@telegram.org; report privately first.
- 3Users
'Hacking tools' and 'account recovery for a fee' are scams.
Updated
