Bybit Flags Telegram Android Bug, Tells Users to Update Now

Bybit didn't wait for a patch note. The exchange told Android users on Friday to update Telegram right away, after a flaw let a single chat message run code on their phones. “A compromised device could also put other apps at risk,” Bybit warned, and exchange and wallet apps usually share the same handset.

The trail starts on November 9, when Telegram began letting bots send “widgets” — small apps tucked inside a chat message, according to tbreak. Security firm V12 showed the payoff two days later with a video in which a bot message opened an Android phone's Calculator app on its own. That's remote code execution: an outsider making a device run commands it shouldn't. V12 hasn't published how the attack works, and Kod.ru reports that no independent party has confirmed it.

Telegram says the hole is closed. “This issue in Telegram for Android was fixed yesterday, and the fix was deployed to all users earlier today,” the company posted on November 11. Meanwhile, dev.ua turned up no evidence of real-world attacks.

There's money in the mix. Widgets carry payments in Gram, the TON blockchain's currency formerly known as Toncoin, routed through Telegram's self-custody wallet, where no company can reverse a transfer. Pavel Durov said more than 1 million of those wallets went live within 48 hours, per TokenPost. dev.ua also warned that code running with Telegram's access could theoretically reach the data that keeps an account logged in, and two-factor authentication does nothing for sessions already open.

It's Telegram's second Android code-execution flaw in a month, following a voice-call bug disclosed by NebuSec. Bybit knows what that kind of breach costs: it lost about $1.5 billion in February 2025, after hackers the FBI tied to North Korea compromised a developer's computer at its wallet provider. The exchange urged users to steer clear of unknown bots, chats and links, and to trust only its verified channels. Telegram hasn't said whether iPhone or desktop users were exposed, and widgets are set to reach group chats with no date announced.