How hackers, fraudsters, and drug dealers are leaving Telegram after Durov’s arrest, joining Signal

Following the arrest and subsequent charges against Telegram CEO Pavel Durov, a diverse group of criminals, including hackers, fraudsters, and drug dealers, are either deleting their Telegram accounts or moving their contacts to alternative messaging apps, as per a new report.

This shift is evident from various screenshots of Telegram conversations and reports from those involved in illicit activities, as per a report by 404 Media.

While there is no clear sign of a widespread exodus from Telegram, it is apparent that some major criminal elements are planning to transition from the platform to more secure messaging apps.

The concern among these individuals is that their Telegram data might be accessed by authorities or that their accounts could be compromised. This apprehension has further been fuelled by Durov’s recent statements about reworking an refocusing on content moderation on the platform.

Reports have emerged of hackers and fraudsters expressing worries in their common groups about losing crucial contacts and are planning to migrate to apps like Signal. For instance, a hacker previously linked to recent Snowflake breaches has indicated a gradual shift of contacts to Signal due to fears of data loss and account security.

Similarly, a message from someone involved in KYC (know-your-customer) bypasses has urged others to save any important chats before deleting their Telegram accounts, citing safety concerns in light of Durov’s arrest.

The charges against Durov include allegations related to Telegram’s refusal to hand over user data in response to lawful requests. Durov has since pledged to improve content moderation on Telegram, which may lead to increased cooperation with law enforcement agencies.

This potential shift is seen as Telegram moving towards a more conventional approach to content moderation, similar to other communication platforms like Discord and Twitter.

Valdemar Balle, an open-source intelligence analyst at the non-profit Digitalt Ansvar, has provided screenshots showing Danish drug dealers encouraging users to join backup groups on Signal. These messages highlight a growing trend of drug dealers and other criminals creating backup groups on Signal and other encrypted apps like Session in anticipation of a possible migration.

Kee Jeffreys, co-founder of Session, told 404 Media of a small increase in users since Durov’s arrest. He emphasised that Session, like other encrypted messaging platforms, operates within technical constraints to prevent misuse while protecting user privacy. Despite this, most users of such platforms are everyday people valuing their privacy, rather than those seeking to exploit the system.

Telegram operates differently from more specialised encrypted messaging apps. It functions more like a social network with massive channels that are not end-to-end encrypted, making it attractive to criminals for broadcasting illegal activities.

This functionality allows drug dealers and ransomware groups to publicise their operations effectively. However, not all users moving to Signal are concerned about the loss of broadcasting capabilities; some, like the aforementioned hacker, are primarily focused on maintaining a low profile.

Durov’s arrest on August 24 at a French airport was linked to an investigation initiated by an undercover agent who encountered a suspected predator on Telegram. The subsequent refusal by Telegram to provide the user’s real identity led investigators to focus on the platform itself.

The French National Gendarmerie, which has previously made numerous requests to Telegram, charged Durov with complicity in enabling illegal transactions, obstructing lawful intercepts, and facilitating crimes such as child abuse and drug trafficking.

Initially, Telegram responded to the charges by asserting that Durov had nothing to hide and dismissing claims of platform responsibility for abuse. However, following the charges, Durov acknowledged that while the vast majority of Telegram users are not involved in crime, the actions of a tiny fraction negatively impact the platform’s reputation.

He also announced the removal of features like People Nearby, which had been misused, and updated Telegram’s website to allow users to report illegal content directly to moderators.

This series of events highlights a significant moment for Telegram as it grapples with increased scrutiny and the potential need to adapt its approach to content moderation in response to legal pressures and shifting user dynamics.