Fake Telegram bots and 'verify' gates
Fake 'Safeguard' verification bots and fake trading bots trick you into running code, pasting a login or importing your private key.
How it works
Fake verification bots sit in a group's welcome flow and ask you to 'prove you're human'. The steps get you to paste a command into your computer or to log in to a fake Telegram page, which hands over your account and then your wallets.
Fake trading bots copy the look of real ones and ask you to import your wallet's private key, or to deposit into a 'bot wallet' they control.
Once they have your Telegram account, they message your contacts with the same trap.
Red flags
- A verification step that asks you to run a command or paste anything into your computer
- A bot asking for your private key or seed phrase
- A bot with a name almost the same as a popular one
Protect yourself
- Never paste commands from a Telegram 'verification' into your computer
- Never import a private key into a bot you didn't find through the project's official site
- Turn on Telegram two-step verification
If you already signed
- End all other Telegram sessions and turn on two-step verification
- Move funds from any wallet whose key the bot saw
- Warn your contacts
Incidents using it 1
-
High✕Still active
FEMITBOT: fake Telegram bots and Mini Apps impersonate crypto brands to take deposits and push Android malware
CTM360 found a shared fraud platform, FEMITBOT, behind many Telegram bots that open Mini App phishing pages inside Telegram, impersonating crypto services such as MoonPay (other outlets also list Bitget, OKX, Binance and Fragment) plus streaming and AI brands. Victims see fake balances and earnings and are told to deposit money or recruit others to 'unlock' withdrawals; some Mini Apps also push Android APK malware. No total losses have been published. Do not start bots or open Mini Apps from ads or unsolicited invites, and never pay to withdraw 'earnings'.
Telegram users targeted with fake crypto and investment bots (impersonating MoonPay and other brands)·Multiple EVM chains·Since May 3, 2026·