Telegram’s tightened moderation failed to dislodge cybercrime

Telegram’s crackdown on cybercrime has intensified dramatically, but the platform still appears to be the industry standard for threat actors.

A new Check Point Research report says Telegram removed more than 43.5 million channels and groups in 2025, yet cybercriminals largely stayed put and adapted instead of migrating elsewhere.

That finding lines up with what KELA reported in late 2024, when early predictions of a mass exodus after Pavel Durov’s arrest and Telegram’s privacy policy changes failed to materialize. More than a year later, the latest data suggests Telegram never really managed to shake off its cybercrime problem; it only forced threat actors to become more evasive.

Telegram, launched in 2013 by Pavel and Nikolai Durov, has grown into one of the world’s largest messaging platforms, surpassing 800 million active users. Its combination of channels, groups, bots, and broad reach made it attractive not only to legitimate users and political activists but also to fraud operators, carding communities, hackers, and extremist networks.

According to Check Point Research, meaningful enforcement began only in February 2025, ending years during which cybercriminal communities were able to operate on the platform with relatively little friction.

Check Point says Telegram now publishes moderation statistics and has disclosed the use of GenAI to support enforcement efforts. The researchers say 43.5 million channels and groups were blocked during 2025, with many of the communities disrupted between February and April linked to carding, Fullz, and hacking activity. The data also shows sharp spikes in blocked-source messages during that period, especially in March 2025.

Still, disruption did not turn into displacement. Check Point says it found no meaningful migration from Telegram to rival platforms. Comparing invite links shared across underground communities over the past three months shows Telegram at 3 million mentions, far ahead of Discord at 153,000, Signal at 8,000, Element at 6,000, and SimpleX at 3,000.

One small exception concerns the Russian-speaking AKULA group briefly shifted to SimpleX in early 2025, along with its affiliated “BF Repo” chat, but later returned after followers failed to make the jump. In practice, alternative apps appear to be used mainly for one-to-one conversations, while Telegram remains the main public-facing hub for announcements, recruitment, and audience reach.

Threat actors have instead adjusted their tactics to survive moderation. Check Point says they increasingly use Telegram’s “Request to Join” feature to keep out automated monitoring, add bogus disclaimers that tag Durov and claim compliance with platform rules, and build backup channels in advance so communities can quickly regroup after takedowns.

The data shows that Telegram’s enforcement has become stronger, broader, and more automated than before, but the platform remains deeply embedded in the cybercrime ecosystem.