QRsafer LogoQRsafer
QR Code Scams on Telegram: How Attackers Hijack Accounts and Drain Crypto Wallets
← Back to blog

QR Code Scams on Telegram: How Attackers Hijack Accounts and Drain Crypto Wallets

Telegram QR code scams exploit the platform's own login feature to instantly hand attackers access to your account — no password required. Here's how the three main variants work and what to do if you already scanned.

2026-04-25 · QRsafer Team

A QR code appears in a Telegram DM. The sender — someone in a trading group you follow — says it's a verification code to access a private investment channel, or proof of an airdrop you qualify for, or a link to an exclusive platform. Telegram QR code scams weaponize the same open, pseudonymous culture that makes Telegram popular, and they exploit the platform's own authentication infrastructure to do it.

Here's how each variant works.

Vector 1: The QR-login account hijack

This is the most dangerous Telegram scam because it requires no password and produces instant results.

Telegram offers a QR login option on its desktop and web clients: the app displays a QR code on the login screen, you scan it with your phone, and authentication is complete — no password, no SMS code. It's a legitimate convenience feature. Attackers weaponized it.

The exploit is simple. The attacker opens Telegram's login page on their device, which generates a time-limited QR code. They screenshot that code and send it to you — usually via a DM from a compromised account or a fake "Telegram Support" profile — with a cover story:

  • "Scan this to verify your identity and keep your account active"
  • "Admin needs you to re-authenticate before the channel reopens"
  • "Scan to confirm your membership in the private group"

If you scan it with your Telegram app — which is exactly the action Telegram's own feature is designed for — the attacker's device is authenticated into your account immediately. They can now read your messages, contact your connections, post in your channels, and lock you out.

The rule: Telegram support never contacts users by DM. Any QR code that arrives via a DM or group message claiming to be for verification is a scam.

Vector 2: Crypto giveaway and investment QR codes in public channels

The second variant targets the large crypto-trading and investment communities concentrated on Telegram.

Attackers join legitimate channels or create near-identical impostor channels — often with the same name, profile photo, and pinned messages — and post announcements designed to look official:

  • "Exclusive airdrop for subscribers — scan the QR to connect your wallet and claim within 2 hours"
  • "New exchange launch — verify your wallet address to receive your bonus allocation"
  • "Whitelist is open — scan to register before spots fill"

The QR code leads to a phishing site styled as a crypto exchange or Web3 wallet interface. Victims are prompted to connect a wallet using WalletConnect or a similar protocol and "approve" a transaction that actually grants the attacker full control over the wallet's assets. In other cases, the fake site asks directly for a seed phrase under the guise of "wallet recovery" or "identity verification."

Crypto transactions are irreversible. Once assets are drained via a malicious wallet approval, there is no recourse.

For a detailed breakdown of how this category of fraud works, see our guide to crypto QR code scams.

Vector 3: Fake "exclusive platform access" QR codes in trading DMs

The third variant is lower-tech but effective because it exploits one of Telegram's defining features: DMs from strangers are permitted by default.

Attackers create accounts that appear to belong to successful traders, analysts, or fund managers — often with fabricated screenshots of gains and testimonials pinned to their profiles. They message users who are active in public trading groups, offering access to a "private signals channel" or "exclusive algorithmic trading platform." The access, they say, requires scanning a QR code.

The code leads to one of two places: a credential-harvesting page mimicking a real financial platform, or a payment page asking for a subscription fee to access the "exclusive" service that does not exist.

Because Telegram's open messaging makes it easy to reach thousands of users, this scam scales efficiently. The same attacker can run dozens of accounts simultaneously.

For comparison, an identical pattern appears on WhatsApp, where QR codes sent via DMs from unfamiliar contacts follow the same playbook.

What to do if you scanned a suspicious Telegram QR code

If you may have scanned a login QR code:

  1. Open Telegram immediately and go to Settings → Privacy and Security → Active Sessions.
  2. Terminate every session you don't recognize — there is a "Terminate All Other Sessions" option if you're unsure which device is which.
  3. Enable two-step verification under Settings → Privacy and Security if it isn't already on. This requires a password in addition to the SMS code for future logins.
  4. Review recent messages sent from your account and notify contacts if anything was sent without your knowledge.

If you connected a crypto wallet or approved a transaction:

  1. Revoke the malicious approval immediately using a tool such as Revoke.cash, which shows and cancels active token approvals by contract.
  2. Move remaining assets to a new wallet address not linked to the compromised session.

If you entered payment information:

  1. Contact your bank or card issuer to block the card and dispute the charge.
  2. Monitor your accounts for further unauthorized activity.

What to remember on Telegram

  • Telegram does not send account-verification QR codes via DM. Any QR code framed that way is a scam, regardless of how official the sender looks.
  • Legitimate crypto airdrops, whitelists, and giveaways link to official websites — they do not post QR codes in Telegram channels.
  • Never scan a QR code received in a DM, even from an account you recognize — it may be compromised.
  • Scan every QR code with QRsafer before acting on it.

See also

Download QRsafer for iOS or Android and run it on any QR code that surfaces in your Telegram feed before your account or wallet pays the price.

FAQ

Can scanning a QR code on Telegram really give someone access to my account without my password?

Yes. Telegram's QR login feature lets you sign in by scanning a code with your phone — no password or SMS code required. Attackers generate a real Telegram login QR code on their own device, screenshot it, and send it to you with a cover story like 'verify your account' or 'join this channel.' The moment you scan it with your Telegram app, the attacker's device is logged into your account instantly. Two-step verification does not block this flow if you approve it inside your own app.

I scanned a QR code in a Telegram DM and now I'm worried. What should I do?

Act immediately. Open Telegram and go to Settings → Privacy and Security → Active Sessions. Terminate any session you don't recognize. Then change your password and enable two-step verification if it isn't already on — this adds a password layer that protects future login attempts. Notify contacts in your channels or groups that your account may have been accessed without your knowledge, as attackers often use compromised accounts to spread the same scam.

Are QR codes in Telegram channels for crypto giveaways ever legitimate?

Almost never. Legitimate crypto projects and exchanges do not require you to scan a QR code inside a Telegram channel to claim an airdrop, join a whitelist, or receive a bonus. This is a hallmark of fraud. Real project announcements link to official websites with clearly registered domains — they don't post QR codes in chat. If a channel posts a QR code for any financial action, treat it as a scam.

Does QRsafer protect against Telegram QR code scams?

QRsafer scans any QR code — including screenshots from Telegram — and checks the destination URL against threat databases before anything loads. For phishing QR codes pointing to fake investment platforms or credential-harvesting pages, QRsafer will flag the destination as Risky or Dangerous. For the QR-login exploit, the code resolves to a legitimate Telegram URL, so the best defense is knowing never to scan a Telegram QR code received via DM or an unfamiliar channel. Use QRsafer on every code you're unsure about.