Our shocking investigation: Telegram and how pedocriminal networks make millions of dollars
- Admin
- 5 days ago
- 8 min read
Summary
1. Telegram, a controversial messaging app
Telegram has had a more than dubious reputation for years. Presented as a "secure", "encrypted" and "defender of freedoms" messaging service, it has in reality become a veritable mainstream Dark Web , accessible to everyone, directly from a mobile phone.
What once required technical skills, the use of anonymizing networks, or access to hidden forums, is now just a click away , without any real barriers. Telegram is no longer just a messaging application: it's a parallel platform , out of control, outside the norm, and beyond accountability.
This reputation is not a fantasy, nor is it militant exaggeration. It is based on facts , repeated observations , and now on in-depth investigations , including the one we present here.
2. Telegram, a real tool for cybercriminals, and especially pedophiles
Telegram is today one of the most used tools by cybercrime networks , and more specifically by international pedophile networks .
The platform offers a set of features ideal for these criminals:
facilitated anonymity,
lack of real control
very little visible moderation
ephemeral content,
removal of traces
reports deliberately complicated or impossible.
Pedophilia, financial scams, fake crypto investments, fraud, sextortion, blackmail, harassment, money laundering: it's all there , without distinction, without compartmentalization, without serious restraint.
But what we have discovered far exceeds what one could imagine.
3. Our shocking investigation: infiltration of pedophile networks on Telegram
Our association WAAD – Web Abuse Association Defense conducted, for several months, an in-depth infiltration investigation of pedophile networks present on Telegram.
Beyond even the visual horrors, the unbearable images of pedophilia and child pornography, what we have discovered is beyond comprehension .
These are not isolated cases, nor are they petty criminals acting alone. We are talking about organized, structured, hierarchical global networks , with:
catalogues,
commercial methods,
means of payment,
and revenues of several million dollars .
We are facing a market of horror .
3.1 Infiltration Protocol
How and where do we find these accounts?
Some of the accounts come to us via reports received by our association. But in many cases, it's enough to just search .
On TikTok and X (Twitter) in particular, it is very easy to find accounts that take on the appearance of attractive young women . In the majority of cases, these are stolen photos , coming from OnlyFans or other platforms.
These accounts use very specific codes :
keywords repurposed,
emojis,
explicit or coded references (pizza, CP, etc.).
👉 These codes are also detailed in our previous article dedicated to the communication codes of pedophiles .
The pattern is almost always the same: an invitation to "buy content", "see the menu", or "join the channel"... on Telegram .
The infiltration
We always proceed in the same way . A simple, vague, deliberately imprecise initial contact :
“Hi, what do you suggest? ? »“Menu? »
No specific request. No explicit mention. The objective is clear: not to influence , not to direct the response, not to arouse suspicion.
The salespeople opposite are in a hurry, eager, and organized . Very quickly, they launch into their sales pitch:
description of contents,
ages,
types of acts,
formats,
price,
and finally a BTC address for payment .
Telegram's impunity and laxity are such that some accounts already display child pornography images as their avatars . Others directly publish equivalent, or even worse, content in their public posts, clearly stating their intentions.
In these cases, further dialogue is sometimes unnecessary . The BTC address is sufficient to continue the financial investigation.
3.2 What we found: our assessment
We have infiltrated over 200 accounts belonging to pedophile vendors .
Some proudly display their catalogue , hosted directly on Telegram. Others are more discreet:
neutral or non-existent avatar
baiting via ephemeral videos .
For those who don't know what it is:
👉 These are videos that can only be viewed on mobile devices and disappear after playback. They are neither viewed nor known.
Screenshots are also disabled there , for even more discretion and impunity.
We have collected blatant , repeated, irrefutable evidence of the widespread , systematic and consistent dissemination and sale of child pornography .
4. Telegram is deceiving its users with its so-called moderation.
Telegram proudly displays a summary of deleted accounts on its website:
They claim to respond to reports from associations and users, and assert that they have proactive moderation .
“In addition to its proactive measures and user reports, Telegram processes thousands of reports on CSAM from global third-party organizations via automated takedown addresses:
The table lists the top four NGOs that submitted takedown reports to Telegram in 2025.”
But what is the real story ?
We really looked into the matter . We explored, tested and put to the test this displayed moderation and this supposed desire to do well.
👉 The situation is simply catastrophic and alarming.
4.1 User reports
Telegram's ecosystem is designed to minimize user reports as much as possible .
He is :
It's impossible to report a photo or video in the messaging system.
It's impossible to report on a video that's ephemeral.
It is impossible to report a specific message.
It is impossible to report to a profile .
It is only sometimes possible to report to a profile picture or a post.
We made 100 user reports , where technically possible.
👉 Less than 10% of these reports resulted in account deletion.
👉 And when some accounts were deleted, it happened after several days, or even several weeks .
👉 Between 2 and 15 days after a report.
Meanwhile, pedophile cybercriminals quietly continue their activities, sales and distribution.
4.2 Email reports of abuse
We also sent fifty emails to Telegram's official abuse addresses.
We deliberately mixed:
"Random" emails, as if a well-intentioned user were making a report.
and other emails sent from our official registered association address .
Result :
👉 No response,
👉 No accounts deleted ,
👉 absolutely nothing .
Pedophile accounts are still active at the time of writing this article.
Telegram completely ignores abusive emails . This isn't an opinion. It's a fact.
4.3 The famous proactive moderation
Given the scale and number of accounts displaying pedophilic photos and videos in their avatars and public posts, it is difficult to imagine that any proactive moderation exists.
You only need to look at the dates these child pornography publications were posted online .
Some accounts host dozens of posts , and the oldest are sometimes more than a year old .
Example account:
B ********
– online with pedophilic content since 26/06/2025 (2nd publication)
– still online with a 14th pedophilic publication dated 09/11/2024
Other accounts with posts date back a few days to a few weeks.
All of these accounts have been reported .
👉 Only one was deleted, after 7 days .
👉 The others are still active and online .
Clearly, there is no proactive moderation , or it is so light and lax that it only controls a tiny fraction of the content published.
This observation is all the more shocking given that a company like Telegram has ample technical, human and financial resources to implement moderation worthy of the name.
4.4 Conclusion and summary of the Telegram moderation test
The entire Telegram ecosystem is designed to discourage reporting :
Internal deferral options are intentionally limited.
Abuse emails ignored,
Proactive moderation is virtually non-existent.
👉 Everything is done to promote cybercrime , and in particular the sale and distribution of child pornography.
This is not an accident. This is not a lack of resources.
That seems to be a choice .
5. Telegram offers a perfect ecosystem for the enrichment of criminal networks.
At first glance, one might think that these are small groups of cybercriminals earning $50 or $100 from time to time.
But don't be mistaken.
Thanks to Telegram, this nightmare has transformed into a veritable industry of crime and pedophilia .
What was once difficult to access, hidden in the corners of the Dark Web, is now directly on your phone , just a few clicks away.
Telegram is the gateway. And these pedophile networks are making millions of dollars .
We traced BTC addresses and explored the blockchain to identify the ramifications and mechanisms of money laundering .
The pattern is almost always the same:
a first tier receiving payments (50 USD here, 120 USD there),
transfer to another address which also receives several small amounts
then a third level of grouping with larger discounts,
and so on…
👉 Until reaching a wallet address holding over $24 million .
The full investigation file is available here:
6. Why isn't Telegram doing anything? Our analysis
Telegram is the worthy successor to the first encrypted phones, such as Phantom Secure , which in their time offered:
remote erasure,
encrypted messaging
marketing discourse focused on the protection of activists, journalists and whistleblowers.
In reality, these tools were being used extensively by global drug trafficking . The FBI eventually put an end to this charade.
Telegram didn't invent anything. Its founder, Pavel Durov , didn't invent anything either.
He uses exactly the same terms , the same discourse, the same stance: freedom of expression, censorship, persecution, police state.
Meanwhile, Telegram has become the world’s largest criminal marketplace : financial scams, crypto, fraudulent trading, pedophilia, scammers, harassment, blackmail, sextortion… it’s all there.
The lack of moderation, which we have proven above, demonstrates a total lack of will to create and maintain a clean and secure messaging system.
As with Phantom Secure, the lack of cooperation with law enforcement is blatant. Pavel Durov was even arrested in France to answer for these shortcomings.
With each attack, the same reflex: to wave the flag of censorship, persecution and threatened freedom of expression.
In interviews, Pavel Durov goes so far as to claim that France has committed "the worst abuse of rights" against him, even though his messaging service is riddled with pedophilia and no serious moderation is in place .
We always see the same patterns:
"There's child pornography in your inbox."
"Look, they're trying to censor us!"
"There are a huge number of accounts that sell and host child pornography."
"Look, we're being attacked again! Your freedom of expression is in danger!"
Pavel Durov cries scandal over censorship, while totally ignoring complaints and abuses on his Telegram messaging service.
This pseudo-libertarian stance is in reality a cold, calculated, and perfectly oiled machine . Cybercrime appears to be an integral part of its market share.
7. And now?
How far must we tolerate the horrors of pedophilia in order to supposedly protect freedom of expression?
Should a company like Telegram continue to offer an ecosystem that allows criminal networks to earn millions of dollars ?
Should we tolerate the circus of this entrepreneur, who advances masked as a liberator of speech and defender of freedoms, while behind it hides a criminal system of horror , made up of child rape and organized crime, having built empires thanks to a single tool: Telegram .
This investigation file will be communicated to the competent authorities, who remain solely empowered to assess its scope and determine the appropriate follow-up.
Comments