Bybit Warns Users to Update Telegram's Android App Over RCE Flaw

Crypto exchange Bybit has urged users to update Telegram's Android app immediately, after security researchers demonstrated a vulnerability that allows remote code execution through the messaging platform's Widgets feature.

The warning landed this week, days after security research company V12 disclosed the underlying flaw. V12 found that Telegram's Widgets feature — the mechanism that displays interactive content inside chats — can be abused to execute code on a target device. In a published test, the researchers showed that a bot message could launch a calculator app on an Android phone, proving that a chat message alone can trigger execution on the handset.

What is Bybit telling users to do?

Bybit framed the risk as broader than Telegram itself. When a phone's security is compromised, the exchange said, the exposure may not stay contained within one app and could affect other applications on the same device. For crypto users, that matters: wallet apps, authenticators and exchange apps often sit on the same handset as the messenger.

The exchange's guidance to users was specific:

• Update Telegram's Android app immediately.
• Avoid unfamiliar chat rooms and bots.
• Do not open suspicious links.
• Follow announcements only from verified official channels.

Android users can verify whether the patch has reached their device by checking Telegram's official page on Google Play, Bybit said.

Why does a messaging flaw matter for crypto?

The attack path V12 demonstrated is the kind that has historically plagued crypto communities on Telegram, where airdrop groups, trading bots and project announcements are commonplace. A bot message that can execute code on an Android device turns an ordinary chat into a delivery mechanism for malware. If the compromise extends beyond Telegram to other apps on the phone, as Bybit cautioned, the blast radius could include anything from session tokens to locally stored wallet data.

Telegram has announced that the vulnerability has been fixed. That means the practical risk now sits with users running outdated builds — anyone who has not pulled the latest version from Google Play remains exposed to the Widgets attack vector.

What happens next?

The burden shifts to patch adoption. Users who delay the update, or who continue engaging with unverified bots and links, keep the window open. Bybit's advice to treat unfamiliar bots and links as hostile is standard operational security, but the exchange's decision to push the warning publicly signals how seriously it rates the threat to its own user base.