WuBlockchain
Bybit issued a security advisory on November 13 urging users to update Telegram for Android immediately, after reports of a vulnerability that could let a compromised device put other applications at risk.
The warning follows a disclosure by security research firm V12 of a remote code execution flaw in Telegram's Widgets feature. Researchers demonstrated that a single bot message could launch the Calculator app on an Android device without user interaction. Telegram has confirmed the vulnerability is fixed and the patch has rolled out to users.
Why it matters
For crypto holders, the risk is not Telegram itself but what a compromised phone exposes. Bybit advised users to avoid unfamiliar chats and unknown bots, refrain from opening suspicious links, and trust only verified official channels.
The advisory lands days after Binance, on November 10, flagged a separate iOS flaw known as worse_query, which could allow malicious apps to read files belonging to other applications, potentially exposing crypto wallet seed phrases, private keys, and login credentials.
Market impact
Two major exchanges issuing mobile security warnings in the same week signals elevated concern around wallet-draining attack chains that start with messaging apps. No exchange reported user losses from either flaw. The practical takeaway for readers is straightforward: update Telegram on Android now, and treat unsolicited bot messages and links as hostile until proven otherwise.
Frequently asked questions
-
What is the Telegram Android vulnerability Bybit warned about?
It is a remote code execution flaw in Telegram's Widgets feature, disclosed by security research firm V12. Researchers showed a bot message could launch the Calculator app on an Android device without user interaction.
-
Has the Telegram vulnerability been fixed?
Yes. Telegram confirmed the vulnerability has been fixed and the update has been rolled out to users. Bybit still urges users to update Telegram to the latest version immediately.
-
How does the Telegram bug put crypto wallets at risk?
Bybit warned that a compromised device could put other applications at risk, meaning a phone attacked through Telegram could expose crypto apps, wallet data, and credentials stored on the same device.
-
What is the worse_query iOS vulnerability Binance warned about?
On November 10 Binance warned of an iOS flaw known as worse_query that could allow malicious apps to read files belonging to other applications, potentially exposing crypto wallet seed phrases, private keys, and login credentials.
-
What should users do to stay safe from these mobile flaws?
Bybit advises updating Telegram to the latest version, avoiding unfamiliar chats and unknown bots, not opening suspicious links, and trusting only verified official channels.
TheBlock
CoinTelegraph
CryptoSlate
CoinDesk
Crypto News