Telegram has exploded as an alternative to the dark web where criminals buy, sell, and share stolen data and hacking tools
New research shows growing network of hackers sharing data leaks on encrypted messaging app — Telegram has exploded as a hub for cybercriminals looking to buy …
Context & Ripple Effects
Telegram's illicit-use problem is not new, but it keeps changing shape. Back in 2018 the app was already carrying pirated movies and stolen Netflix credentials; by January 2021 it had 11.9M downloads the week of the Capitol riot and made its first-ever shutdowns of public white supremacist groups. The FT's new research marks the next stage: organized cybercriminal commerce — stolen data, leaks, and hacking tools — migrating out of dark-web markets into open Telegram channels.
First-order effects
- Buyers and sellers of stolen data gain a lower-friction venue: no Tor setup or marketplace escrow, just searchable encrypted channels with built-in audience.
- Law enforcement loses its most reliable lever — dark-web market seizures — because Telegram channels are distributed across millions of users rather than hosted on a single server that can be taken down.
Second-order effects
- Telegram faces the same moderation pressure it answered once before, when scrutiny after the Capitol riot forced it to ban extremist channels — and the 2024 analysis of 3.2M+ messages showing rampant criminal activity suggests those earlier removals did not change the underlying dynamics.
- The platform sits at the center of a converging illicit stack: alongside the data bazaars, reporting ties Telegram to crypto-powered money laundering, meaning the app's criminal economy compounds rather than stays siloed.
Third-order effects
- If the pattern holds, illicit online commerce structurally shifts from seizable dark-web marketplaces to encrypted messaging networks, forcing regulators to target platforms themselves rather than individual venues.
- Telegram's business model — rapid growth funded increasingly by crypto-linked revenue like its Toncoin deals — collides with the cost of policing the activity that growth attracts, an emerging legitimacy gap between monetization and moderation.
The trend: Illicit digital markets are migrating from dark-web marketplaces into mainstream encrypted messaging apps faster than either platform moderation or regulation can adapt.