Bybit warns Android users to update Telegram over security flaw
Bybit issued a security advisory after research firm V12 disclosed a remote code execution flaw in Telegram's Android app, warning that compromised devices put exchange accounts at risk.
Key takeaways
- 1Bybit issued a security advisory on Nov 13 regarding a Telegram Android vulnerability.
- 2Security firm V12 demonstrated a remote code execution flaw in Telegram's Widgets feature.
- 3Telegram confirmed the flaw has been patched and rolled out an updated Android build.
- 4Bybit recommended four steps, including updating Telegram and avoiding unfamiliar bots.
Cryptocurrency exchange Bybit issued a security advisory on Nov 13 warning users that a remote code execution vulnerability in Telegram for Android could put other applications on compromised devices at risk. Bybit urged all users to update their Telegram application immediately to prevent potential security breaches affecting their exchange accounts.
The warning followed findings published by security research firm V12, which detailed a remote code execution vulnerability within Telegram's Widgets feature on Android devices. In its demonstration of the flaw, V12 showed that a specially crafted bot message could execute code on a victim's device without permission, successfully launching the native Calculator application as proof of concept.
Telegram acknowledged the issue, confirmed that the vulnerability had been patched, and released an updated build of the application to Android users. Despite the patch, Bybit warned that devices running older versions of Telegram remain susceptible to exploitation, which could allow malicious code to interact with or compromise other mobile applications installed on the same device.
To minimize exposure to device-level risks, Bybit outlined four specific recommendations for its users. The exchange advised customers to update Telegram to the latest version without delay, avoid entering unfamiliar chats or interacting with unknown automated bots, refrain from opening suspicious links regardless of appearance, and verify all communications against Bybit's official published channels.
Crypto exchanges frequently warn users about third-party application flaws because mobile devices often store sensitive access credentials, session keys, or multi-factor authentication tokens. Unpatched vulnerabilities in widely used messaging platforms present an entry point for attackers targeting user assets stored across connected mobile software.
Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.