Why the data was already on the platform
Platform mechanics explain this migration away from onion services and criminal forums, not ideology. Telegram's own FAQ sets the limits. Files up to 2 GB each on a free account and 4 GB with Premium, groups of up to 200,000 members, channels with an unlimited number of subscribers. A stealer log is a compressed directory of cookies, autofill data, wallet files and credential text, so a daily pack of hundreds of logs is one or two messages, with nothing to host.
Then the bot API. Much infostealer malware posts its archives straight to a Telegram bot token, which is why operator chat IDs are recoverable from samples. The data arrives as a by-product of the theft, so distributing it there costs nothing extra. Hosting, storefront, payment and delivery automation, and advertising reach collapse into one free service.
The reach is the part with no precedent: the 339 channels in the DarkGram sample held 23.8 million subscribers between them.
The architecture, and the policy that produced it
The moderation boundary quoted above is the design constraint the whole ecosystem is built around. Public content, including channels and bots, is reportable and gets taken down. The private layer is outside the reporting process entirely, by stated policy rather than by technical accident.
An ecosystem that must advertise but does not want to be reported will therefore split in two, and it has. Of the 1,521 channels in the Cambridge and Carnegie Mellon sample, 448 were private. The connective tissue is small: 155 channels functioning as redirects or portals, with 91 percent of their links directing into private channels. Those gateway channels survive longer and grow faster than ordinary ones, and the authors call them a potential choke point for moderation.
Resilience is pre-provisioned, with dormant sibling channels labelled v2, backup or reserve that activate after a ban. Operators also moved behind Request to Join gating as enforcement intensified, which is a Check Point observation rather than an academic finding.
What has been measured, and what has not
The two studies give real denominators at last. "Stayin' Alive" collected from August 2024 to August 2025 using a custom client against Telegram's official API: 1,521 channels, 14 million messages, 3.6 million media files and 252,000 distinct users. Its message split ran credentials 22 percent, infostealer logs 21 percent, carding 19 percent and databases 18 percent. DarkGram covered 21 February to 29 May 2024, with a live phase to 11 August, classifying 64,801 posts from 339 channels, of which 53,605 were malicious.
What neither provides, and nobody else does either, is a total. No credible independent measurement exists of the number of credentials or logs distributed via Telegram, and the billions of credentials class of claim could not be traced to any disclosed methodology.
That absence is where the circularity lives. A vendor's claim that most stolen data is now found on Telegram is conditioned on that vendor's collection being concentrated on Telegram, and none of them publish a channel denominator, a sampling frame or a deduplication method. Their volume figures measure their collection, not the ecosystem.
Two corrections follow. Check Point's figure of 43.5 million channels and groups blocked during 2025 originates with Telegram's own enforcement data, not with Check Point measurement, so it corroborates nothing independently. And Telegram's live moderation counters, showing 27,199,461 groups and channels blocked in 2026 to date, break out only 437,701 CSAM related and 182,795 terrorism related. There is no stolen data category at all, so those numbers cannot show progress against credential trading. One further limit, because it affects everything after it: no academic measurement of this ecosystem extends past August 2025, so the last fourteen months rest on vendor reporting and agency announcements.
What actually changed after August 2024
Pavel Durov was arrested in France on 24 August 2024. The policy change traces to a dated document: Telegram's Privacy Policy section 8.3, last updated 23 September 2024, which states that on receipt of a valid order from relevant judicial authorities confirming a user is a suspect in a case involving criminal activity, Telegram will disclose that user's IP address and phone number.
That is metadata, not message content, and the distinction is routinely conflated. Telegram's FAQ continues to assert that it has disclosed zero bytes of user messages to third parties, including governments. Both statements can hold at once, so reporting that treats 8.3 as the end of message confidentiality is wrong. What changed is subscriber identification. Telegram's transparency data showed it provided data on 2,253 United States users to United States authorities during 2024, concentrated after the change, and published through an in-app bot rather than a downloadable report, which itself limits auditability.
The effect has been measured by a neutral party. Marjanov and colleagues model the September 2024 shift and its January 2025 implementation and find significantly elevated ban risk, reduced channel longevity, reduced growth, and an initial membership shock that partially recovered.
And the ecosystem stayed. KELA measured 246,903 Telegram links a month from August to December 2024 against 682 for Signal and Discord combined, without disclosing its channel count. Check Point observed roughly 3 million Telegram invite links in a three month window with Discord under 6 percent of that, and recorded one group relocating to SimpleX in early 2025 and returning because its followers did not follow. The academic and vendor evidence are independent and they agree: enforcement became real and costly, channel behaviour changed, and no migration off the platform occurred.
Where law enforcement has reached, and where it has not
The disruption record since late 2024 is substantial, and it is worth stating with the agency figures separated from the vendor ones, because they are routinely merged.
Operation Magnus, against RedLine and META, took place on 28 October 2024 and was announced on 29 October. The Department of Justice says it seized two domains used for command and control under a warrant from the Western District of Texas, and that the joint task force seized domains, servers and Telegram accounts.
Cracked and Nulled were announced as disrupted on 30 January 2025. The Department of Justice lists servers, eight domain names used to run Cracked, the servers and domain of its payment processor and of a related bulletproof hosting service, and the servers and domain of Nulled. No agency states the date the seizures occurred, so the announcement date is the only date to use. Telegram is not mentioned in the release.
LummaC2 needs untangling, because the circulating version of it merges two separate actions. Microsoft's Digital Crimes Unit filed a civil case on 13 May 2025 and obtained an order from the United States District Court for the Northern District of Georgia, and the action was announced on 21 May 2025. The figures that get quoted belong to Microsoft, not to a court or an agency: Microsoft says about 2,300 malicious domains were seized, taken down, suspended or blocked, that more than 1,300 were seized by or transferred to Microsoft and redirected to its sinkholes, and that around 300 of those were actioned by law enforcement with Europol's support. The Department of Justice's own contribution is five domains, two seized on 19 May 2025 and three on 21 May. The Department of Justice release does not mention Europol at all.
Operation Endgame's November 2025 phase ran as an action week from 10 to 14 November 2025 and was announced on 13 November. Eurojust and Europol both state 1,025 servers taken down and 20 domain names seized, against Rhadamanthys, VenomRAT and Elysium. Neither release mentions Telegram.
The June 2026 Endgame phase ran from 15 to 19 June 2026 and was announced on 24 June, against SocGholish, StealC and Amadey. It neutralised 326 servers and 142 domains. Criminal crypto assets valued at over 41 million euros, about 47 million dollars, were identified, flagged and restricted, which Europol's own headline describes as seized. As many as 27 million stolen login credentials were recovered, described by Eurojust as 27 million compromised data sets. Neither release mentions Telegram.
Telegram's place across that record is narrower than it is usually put, and in one direction it is also larger. Telegram infrastructure has been an object of seizure exactly once. In Magnus, the Department of Justice states that Telegram accounts operated by the RedLine and META administrators were among the things seized, and the Dutch National Police states that several Telegram accounts were taken offline, that the stealers were offered to buyers through those Telegram groups so their sale was disrupted, and that criminals who had regarded Telegram as a safe and anonymous service can no longer rely on that. In the other four operations examined, Telegram appears as a sales or rental channel or is not mentioned in the agency releases at all. And no release anywhere describes seizing Telegram bots or channels as such: the Magnus language is accounts, and groups in the Dutch release. No primary source quantifies how many accounts, channels or bots were removed, in Magnus or in any other action.
Two sales channel claims need their sources attached. Lumma's developer marketed the tool through Telegram and Russian language chat forums at tiers of 250, 500, 1,000 and 20,000 dollars, the last including source code access, and that is Microsoft reporting a claim the developer made in a November 2023 interview, not a law enforcement finding. For Amadey and StealC, no agency release describes a sales venue at all, and Microsoft's own June 2026 research describes them as pay as you go malware as a service without naming forums or Telegram as the rental channel. Where Telegram does appear in that research it is as a market for the output rather than the tool: stolen infostealer logs selling on dark web markets and Telegram channels at roughly 10 to 50 dollars per log, with premium logs up to 100 dollars and above. That is a vendor figure about a different thing, and it is the only verified Telegram link for those two families.
One figure needs correcting wherever it appears. The claim that Magnus exposed 227 million credentials is vendor derived, reported alongside the operation rather than by it. The agency documents say only that these families infected millions of computers, that investigators identified millions of unique credentials with the total not finalised, and that there were millions of victims and thousands of customers. We will not restate the larger number as a law enforcement finding, because it is not.
The uncomfortable measurement
The question a defender wants answered is whether any of this reduces the supply of logs. There is exactly one longitudinal attempt, and it is vendor research.
Flare ran an interrupted time series across roughly 44 million logs from June 2024 to June 2026, one record per compromised host, using daily log volume as the outcome with symmetric windows around each announcement. The findings are awkward. RedLine activity tripled in the 90 days after Operation Magnus, with total infostealer market volume up 70 percent at 90 days. After Endgame's November 2025 phase, total market volume rose 41 percent at 90 days. The May 2025 Lumma action was the only operation in the dataset to produce statistically significant sustained suppression, 46 percent down at 14 days and 39 percent down at 90 days, which Flare attributes to that action hitting infrastructure, distribution, monetisation and criminal reputation at once rather than servers alone.
State the obvious about the source. This is vendor research, not peer reviewed, the dataset is proprietary and unreplicable, and it comes from a company that sells credential exposure monitoring and whose piece concludes that monitoring should continue. The method is appropriate and the p values are reported. The incentive is still there.
It is also in tension with other evidence. Trend Micro documented Lumma back in business with stealthier delivery by July 2025, and others reported the same return within about two months. That tension is probably about outcome variables rather than facts, since vendor telemetry measures whether the family returned while Flare measures log supply attributable to it. We are leaving it unresolved rather than picking a side.
No peer reviewed longitudinal study measures infostealer log volume across a takedown. The closest academic work is adjacent: Vu and colleagues at USENIX Security 2025 found that over half the domains seized from DDoS for hire services returned within a median of one day, and that the first wave produced a statistically significant 20 to 40 percent reduction in attack volume lasting around six weeks, with a second wave four months later having negligible effect. Duration, not magnitude, is the finding that transfers.
What this means if you are monitoring it
Three structural properties make Telegram unlike a forum, and no vendor can engineer around them. There is no crawlable index. Roughly a third of the relevant channel population is private, invite gated and unreportable by policy. And the content is opaque attachments rather than indexable text: 54.2 percent of DarkGram's credential posts carried the data as a file and 25.8 percent had a filename and nothing else, so keyword monitoring of message bodies misses the data.
Completeness claims are therefore unfalsifiable. Only 0.8 percent of the channels active before August 2024 in the Cambridge and Carnegie Mellon sample appeared in three major general purpose Telegram datasets covering 208,652 channels between them. Two collectors will see largely different populations and neither can demonstrate coverage. Ask a provider for its channel count, its private channel count, how it re-acquires access after a ban, whether it parses attachments, and what its denominator is when it says most data is found on Telegram.
The posture this supports is outcome based rather than coverage based. Assume credential pairs and session material are already circulating, in combolists and in raw logs, and spend the effort on session invalidation, on detecting session cookie theft and replay, and on stealer log monitoring that reports what was exposed rather than how many channels somebody watches. Where the material is corporate access, it will often surface through an initial access broker first.