Telegram Crypto Scams: How to Spot Them and Trade Safely

Telegram is where a large share of Solana trading actually happens: trading bots, alpha groups, project chats, and support channels all live there. That is convenient, and it is exactly why scammers work the platform so hard. On Telegram, anyone can copy a name, a photo, and a channel description in a couple of minutes, then message you as if they belong there. Almost none of these scams involve breaking encryption or hacking a wallet. They involve getting you to trust the wrong account, click the wrong link, or sign the wrong thing. This guide walks through the scams you are most likely to meet as someone who uses Telegram trading bots, and gives the specific tell and defense for each.

The one thing every Telegram scam needs

Every Telegram scam has the same requirement underneath: an action from you. No attacker can move funds out of a non-custodial wallet just because you happen to be in the same group chat. What they can do is impersonate someone you trust, manufacture urgency, and steer you toward a single decision: paste your seed phrase, send funds to "verify," connect your wallet to a malicious page, or approve a transaction you did not read.

Because the entire con depends on your action, the defenses are behavioral. Slow down at the exact moment you are being rushed, verify identities yourself instead of trusting a display name, and never treat a badge, a bio, or a screenshot as proof of anything. A "verified" label in a bio is just text the scammer typed. Everything below is a variation on that theme, so once you internalize the pattern, each specific scam becomes easy to recognize.

Fake and cloned trading bots

Popular trading bots get cloned. A scammer copies a well-known bot's name, avatar, and welcome screen, registers a handle that is one character off, and promotes it in comment replies, group chats, and paid posts. The clone can look identical right up to the point where it asks you to import an existing wallet by pasting your seed phrase, or where it funnels you to a lookalike website. MoonHydra gets cloned this way too. Fake "MoonHydra" bots and impersonator handles exist, and the only official one is t.me/moonhydrabot.

The tell. The handle is subtly wrong, the bot reached you through a reply or an ad rather than a source you chose, or it asks you to import a wallet by entering your recovery phrase. A real non-custodial bot generates a wallet for you and encrypts it. It never needs your main wallet's seed phrase.

The defense. Verify the exact handle character by character against the project's own website or a pinned post, reach the bot only through a link you found on the official site, and confirm the linked website matches the real domain. If a "bot" ever asks for your seed phrase, it is a thief. If you are new to these tools, our explainer on what a Telegram trading bot is describes how a legitimate one actually behaves.

Admin and support impersonation

The most common Telegram scam is a person, not a link. You post a question in a project group, and within minutes a friendly "admin" or "support agent" slides into your DMs to help. The account wears the real project's logo, uses a name like the genuine moderators, and sometimes has "verified" written in its bio. It is fake. Real admins and real support do not DM you first.

The tell. An unsolicited DM, especially right after you posted in a public group, from a name or badge that implies authority, in a conversation that steadily steers toward your seed phrase, a "wallet sync," or sending funds to "unlock" or "validate" your account.

The defense. Treat every unsolicited DM as hostile by default. Genuine teams handle support in public channels or through a contact method listed on their official site, never by messaging you out of the blue. Turn on Telegram's privacy settings to restrict who can message and add you, disable auto-download of media from unknown senders, and never continue a support conversation that started in your DMs. When in doubt, ask the same question back in the public channel and watch the real moderators answer there.

Fake giveaways, airdrops, and claim links

Free-money bait is everywhere on Telegram: airdrop announcements, "you have been selected" messages, giveaway bots, and claim links, often posted by a cloned copy of a project or influencer you already follow. Increasingly the link opens a Telegram mini app or a web page that asks you to connect a wallet and sign in order to "claim." The signature is the trap. On connect and sign, a malicious page can move your tokens or hand an attacker ongoing permission over them, and on-chain that is instant and irreversible.

A frequent variant asks for a small upfront payment first, a "gas," "activation," "verification," or "tax" fee, to release a much larger prize. There is no prize. Any giveaway that requires you to pay first, or to connect and sign to a page you reached from a DM or a random post, is a scam.

The tell. Unsolicited winnings, urgency such as "claim within the next hour," a pay-to-claim fee, or a claim page that wants a wallet connection and a signature you cannot fully read.

The defense. Assume unprompted airdrops and giveaways are bait. Do not connect your main wallet to claim pages you did not seek out, and never sign a transaction you cannot read. If you interact with these at all, use a throwaway wallet that holds almost nothing, and periodically revoke old approvals so a page you once touched cannot pull tokens later. Our guide on how to revoke token approvals covers that cleanup, and the wallet drainer scams breakdown explains how a single bad signature empties an account.

Pump-and-dump groups and paid signals

Not every Telegram scam steals your keys. Some just separate you from your money the slow way. Pump-and-dump groups promise coordinated buys that will "send it," and paid-signal or "VIP alpha" channels sell calls that supposedly beat the market. In a pump, the organizers and early members are already holding before the announcement. The "signal" to buy is the moment they sell into your bids. Paid-signal services tend to survive on subscription fees and a wall of survivorship-biased screenshots, not on any real edge.

The tell. Guaranteed or suspiciously specific returns, countdowns to a coordinated buy, a paid tier that gates "the real calls," and a feed of winning screenshots with no losers ever shown.

The defense. Treat coordinated pumps as a transfer of money from latecomers to insiders, and assume you are the latecomer. Be equally wary of the token being pushed, because many pump targets cannot be sold at all. Learning to recognize honeypot tokens keeps you from buying something engineered to trap your funds. No legitimate group can guarantee a return, and a channel charging you for the privilege is earning from your fee, not from your profit.

"Verify your wallet" and "sync" phishing

This one deserves its own section because it is so effective. A message, bot, or mini app tells you to "verify," "validate," "sync," or "migrate" your wallet, framed as routine security or a required upgrade. Two versions exist. The blunt one asks you to enter your seed phrase into a form or a bot, and the moment you do, the attacker has full control with no signature even needed. The subtler one sends you to a page that asks you to connect and approve a "verification" transaction, which is really a token transfer or an authority handover in disguise.

The tell. Any request for your recovery phrase, and any "verify by signing" or "verify by sending a small amount" step. Legitimate security never requires your seed phrase or a blind signature.

The defense. Your seed phrase gets typed into your real wallet during setup or restore, and nowhere else, ever, no matter who asks or how official the request looks. If a page wants a signature to "verify," read exactly what the transaction does, and if you cannot tell, reject it. Understanding what a seed phrase is and why it must stay offline is the single most protective piece of knowledge you can carry into any Telegram chat.

A safety checklist you can actually follow

Most of the defenses above collapse into a short list of habits. None of them are advanced, and together they shut down the large majority of Telegram scams:

• Verify handles yourself. Check bot and admin usernames character by character against the official site, and reach bots only through links you found there, not through DMs or ads.
• Assume unsolicited DMs are hostile. Real admins and support never message first. Restrict who can add and message you in Telegram's privacy settings.
• Never share your seed phrase. No bot, page, admin, or "verification" step ever needs it. This rule has no exceptions.
• Never sign or pay to "verify" or "claim." Read every transaction, reject anything unreadable, and walk away from any giveaway that asks you to pay or connect first.
• Use a dedicated trading wallet. Keep a separate wallet with only what you are actively trading, and hold long-term funds elsewhere, ideally on a hardware wallet. Our best Solana wallets comparison covers the options.
• Revoke stale approvals. Periodically clear old token approvals so a page you once connected to cannot move funds later.
• Slow down when rushed. Urgency is the scammer's main tool. A ten-second pause to verify defeats most of these attacks.

For a fuller routine tuned to bot users specifically, work through our Solana trading bot security checklist.

How MoonHydra fits

MoonHydra is a non-custodial Solana trading bot that runs inside Telegram, so it is worth being direct about how it relates to everything above, including the uncomfortable part. Because MoonHydra is popular, it gets cloned. Fake "MoonHydra" bots and lookalike handles exist, and they are run by scammers. The only official bot is t.me/moonhydrabot. Verify that handle exactly before you touch it.

Here is how the real one behaves, and what you can hold any legitimate non-custodial bot to. It generates a wallet for you and encrypts the keys at rest with AES-256-GCM. It does not ask for your main wallet's seed phrase, because it does not need it. Trades route through Jupiter, the established Solana aggregator, and there are no custom smart contracts of ours sitting in the path. Pricing is a flat 1% per trade on both buys and sells, with no subscription, so nobody legitimate will ever DM you asking for a fee to "activate," "verify," or "upgrade" your account. And the team does not message you first; support happens in the official channels, not in a surprise DM from an "admin."

What a bot cannot do is protect you from a scam you carry out yourself, off the platform, by pasting your seed into a fake page or signing a malicious transaction. No software can. The honest framing is that an encrypted, non-custodial trading wallet works well as a dedicated, limited-blast-radius wallet: you fund it for active trading and keep long-term holdings elsewhere, so a single mistake can only reach the slice it touches. If you want to understand why key control matters in the first place, our comparison of non-custodial and custodial bots lays it out.

Bottom line

Telegram crypto scams are not clever hacks. They are social engineering that ends with you doing the damage. Fake and cloned bots, DMs from a "support agent," pay-to-claim giveaways, "verify your wallet" pages, and pump groups all rely on the same two ingredients: a trusted-looking identity and a moment of urgency. Verify every handle yourself, assume unsolicited DMs are hostile, never share your seed phrase or sign what you cannot read, use a dedicated trading wallet, and slow down exactly when you are being rushed. Do that, and there is very little left for a scammer to work with. The single rule that carries the most weight: your recovery phrase and your signature are the only keys to your funds, so guard both like they are.

Next: read the wallet drainer scams breakdown to see how a bad signature plays out, run through the trading bot security checklist, and learn what a seed phrase is so you never expose it. When you want a non-custodial setup, verify the handle and start at t.me/moonhydrabot.