Telegram, the privacy-focused messaging app with over one billion monthly active users as of 2026, has long positioned itself as a bastion of free speech and secure communication. Yet beneath its user-friendly interface lies a sprawling criminal ecosystem. Drug traffickers, weapons dealers, child sexual abuse material (CSAM) distributors, terrorists, scammers, and organized crime networks have exploited the platform’s large public channels, groups, minimal default moderation, and discoverable content to operate at an unprecedented scale.
A landmark 2024 New York Times investigation analyzed more than 3.2 million messages across over 16,000 channels and revealed the extent of the problem. Researchers uncovered open sales of drugs—including cocaine, MDMA, heroin, meth, and cannabis—in at least 22 major channels serving customers in over 20 countries. Dozens of channels advertised weapons ranging from handguns to machine guns. The platform also hosted widespread CSAM, fraud operations, disinformation campaigns, terrorism recruitment and propaganda (linked to groups such as Hamas and ISIS), and racist or extremist incitement. White supremacist networks alone operated around 1,500 channels coordinating nearly one million people globally. The report described Telegram as a “giant black market” and “global sewer” for illegal activity, where criminals could organize efficiently while evading traditional law enforcement scrutiny.
The Scale of Illicit Activity
Telegram’s design features—support for massive public groups and channels (up to 200,000 members), searchable content, and a historically hands-off approach to proactive moderation—made it particularly attractive to bad actors. It effectively became a more accessible alternative to parts of the dark web, requiring no specialized tools like Tor.
Key categories of crime included:
- Drug trafficking: Coordinated sales and “delivery-style” networks, sometimes involving minors.
- Weapons and counterfeit goods: Open marketplaces for firearms and fake items.
- CSAM and exploitation: Widespread sharing and distribution of child sexual abuse material.
- Cybercrime and fraud: Sales of stolen data, ransomware coordination, phishing kits, OTP bypass tools, and elaborate scam rings (including crypto fraud).
- Terrorism and extremism: Propaganda channels, recruitment, and claims of responsibility by designated terrorist organizations.
- Other organized crime: Fake hitman services, money laundering discussions, and coordination of robberies or trafficking.
These activities had tangible real-world consequences, fueling surges in certain crimes in various countries and prompting numerous arrests tied directly to Telegram-based operations. While the vast majority of Telegram’s users engaged in lawful activity, the platform’s scale amplified the impact of the criminal minority.
Pavel Durov’s Arrest and the Turning Point
For years, CEO Pavel Durov and Telegram emphasized user privacy, encryption options, and resistance to mass surveillance or government overreach. Moderation relied primarily on user reports rather than aggressive proactive scanning, with Durov arguing that holding a platform responsible for every user’s actions was unreasonable and that criminals represented a tiny fraction of the user base.
This stance faced a dramatic challenge in August 2024. French authorities arrested Durov at Le Bourget Airport near Paris. He was held for four days and formally charged with multiple offenses, including complicity in managing an online platform to enable illegal transactions by an organized group, as well as failing to prevent or cooperate on issues such as drug trafficking, CSAM distribution, fraud, organized crime, terrorism content, and money laundering. Prosecutors highlighted thousands of unanswered legal requests from French law enforcement. Durov was released on €5 million bail with conditions, including regular police check-ins and an initial travel ban (later eased, allowing him to leave France by March 2025). He has denied wrongdoing, calling the case misguided and politically motivated.
The arrest proved a catalyst for change. In the weeks and months that followed, Telegram implemented significant reforms:
- Expanded proactive moderation using AI to scan public content, including images checked against CSAM databases.
- Updated terms of service and privacy policy to allow sharing of user phone numbers and IP addresses with authorities in response to valid legal requests for serious crimes (previously limited largely to confirmed terrorism cases).
- Enabled users to report illegal content even in private chats.
- Massive content purges: In 2024, Telegram blocked over 15.4–15.5 million groups and channels. In 2025, the figure surged to more than 44 million, including 952,318 CSAM-related and 236,573 terrorism-linked. Blocks continued at scale into 2026, with tens of thousands removed daily and millions of violating pieces of content taken down. The company began publishing detailed transparency reports on these efforts.
Partnerships, such as with organizations combating extremism, and dedicated moderator teams supplemented the AI tools. Criminal channels still reappear in a constant “whack-a-mole” dynamic, and some reports indicate that portions of the underworld have adapted by migrating or becoming more cautious. Nonetheless, enforcement has intensified markedly since late 2024.
The Ongoing Dilemma
Telegram’s transformation highlights a classic tension in digital platforms: balancing privacy, free expression, and safety. Critics long argued that the app’s lax policies enabled harm; privacy advocates warn that increased cooperation and scanning set dangerous precedents for government overreach and could erode legitimate secure communication for journalists, activists, and ordinary users worldwide.
Law enforcement has scored notable victories through international operations targeting Telegram-linked networks, seizing drugs, dismantling fraud rings, and disrupting terrorist propaganda. At the same time, criminals have shown resilience, with some shifting tactics or platforms in response to the crackdown.
As of 2026, Telegram continues blocking millions of violating groups and channels annually while maintaining its core encryption features for secret chats. The platform insists it now exceeds legal requirements in many jurisdictions, and Durov has described the changes as necessary adaptations to rapid growth that inadvertently made abuse easier.
The “massive criminal underworld” on Telegram was—and to a lesser extent remains—real, extensively documented by journalists, researchers, and authorities. It thrived due to the app’s scale, features, and original philosophy. Post-arrest reforms have disrupted many operations and removed vast amounts of illegal content, but perfect moderation on a platform of this size is impossible. Users are encouraged to report suspicious activity, steer clear of dubious channels, and stay vigilant.
For the most current data, consult Telegram’s official moderation transparency page or ongoing investigative reporting. The story underscores that no major platform is immune to misuse, and the balance between liberty and security remains an evolving global challenge.
About The Author
