Telegram Shuts Down Millions of Channels Over Criminal Activity, Report Says

Telegram has carried out one of the most aggressive content crackdowns in the history of social media. It has made little difference.

A new report by cybersecurity firm Check Point Software Technologies, released this week, reveals that despite removing more than 43.5 million channels and groups in 2025, criminal networks on the platform remain largely intact. Daily takedowns rose from a historical baseline of roughly 10,000 to 30,000 to a sustained 80,000 to 140,000, with single-day peaks exceeding 500,000 removals. Yet the threat landscape, the report concludes, is not shrinking.

The reason is straightforward. Cybercriminals have simply adapted. Rather than abandoning Telegram, they have reorganised within it — creating backup channels in advance, using access restrictions to dodge automated moderation tools, and ensuring their content keeps circulating even after original sources are removed.

Kingsley Oseghale, Country Manager for West Africa at Check Point Software Technologies, put it plainly.

“Rather than disappearing, these illicit ecosystems are reorganising, evolving, and staying one step ahead, underscoring a growing paradox: Telegram’s enforcement is record-breaking, but the threat landscape is not shrinking,” he said.

Nigeria Among the Most Exposed

Nigeria has the largest Telegram user base among Africans aged 16 to 64, with an estimated eight million users. The platform’s widespread use for cryptocurrency trading, online betting, and digital commerce makes it a particularly attractive target for fraudsters operating in the country.

The implications are serious. Check Point’s findings show that criminal content continues to spread through forwarded messages, even after the original channels are taken down. Enforcement peaks in February, March, and April 2025 triggered spikes in such forwarded content — meaning the removal of a channel does not necessarily stop the information it carried from reaching new audiences.

Oseghale underscored that takedowns alone are no longer sufficient.

“Telegram’s crackdown is indeed real, sustained, and growing. But so is the adaptability of cyber criminals. Although takedowns are still key, discovering the cyber criminal network surrounding that channel or account is becoming more and more important,” he said.

The evasion tactics documented in the report are sophisticated. Criminal groups restrict group access using “request-to-join” features to block automated detection bots. Others tag Telegram’s own leadership in their channel descriptions, falsely suggesting compliance with platform rules. One notable threat group, AKULA, temporarily relocated to the encrypted app SimpleX in early 2025 but returned to Telegram after its followers refused to migrate in significant numbers.

That detail speaks to a broader reality. Over the last three months alone, Check Point identified approximately 3 million Telegram invite links shared across underground environments, compared to Discord which accounted for fewer than 6% of that volume, while Signal, SimpleX, and Matrix-based platforms barely registered. Telegram remains, by a considerable margin, the platform of choice for organised cybercriminal activity.

Roughly 20% of blocked channels were directly linked to criminal operations affecting businesses — including card fraud, stolen identity trading, and hacking services. The remaining 80% of takedowns swept up content that, while harmful, was not necessarily connected to organised crime networks — further limiting the real-world impact of the crackdown on professional threat actors.

The enforcement push accelerated significantly after the arrest of Telegram founder Pavel Durov in France in August 2024. Durov faced accusations that the platform had become a hub for drug trafficking, money laundering, and child abuse material. Since then, Telegram has increased automation, scaled its moderation teams, and updated its privacy policy to allow the disclosure of user phone numbers and IP addresses to law enforcement upon receipt of a valid court order.

The changes have not been enough. For Nigeria’s eight million users, the Check Point report is a reminder that the app they use daily for commerce, communication, and investment remains a hunting ground for bad actors — and that deleting channels, however many, is only the beginning of solving the problem.