How the dice will fit: Scammers use the Telegram dice game to cheat
Cybersecurity experts have begun recording mass appeals from victims of a fraudulent scheme that exploits people's interest in the new Telegram feature, Izvestia found out. At the end of December, the Emoji Stake bot appeared in the messenger, which allows you to play dice for the TON cryptocurrency. Criminals began to quickly create clones of this game: channels and bots with similar names. There, the user is offered to top up the bot's deposit, he enters payment details, and the money from the online wallet goes to the attackers. However, even the official bot is dangerous — gamers risk losing their money, and the online casino's toolkit violates Russian laws. The RCN reported that the amount of Telegram fines for such violations has already exceeded 130 million rubles.
Gambling in the messenger
Telegram's new gaming feature, Emoji Stake, has become a magnet for scammers, cybersecurity experts told Izvestia. The messenger introduced it at the end of December 2025 — so far it is available only to paid subscribers and allows you to bet money on receiving the native Telegram cryptocurrency (TON tokens) using virtual dice rolls.
The attackers immediately realized the potential of attracting victims through interest in this tool — they promise quick earnings using Emoji Stake, said Igor Bederov, head of the Internet Search company.
— We can see this by the number of appeals from victims. Many victims were misled by bright advertising campaigns promising instant enrichment by betting on TON coins. Of course, most of the time this resulted in a loss of money, since the proposed scheme was exclusively fraudulent," the specialist said.
According to Bederov, the attackers are exploiting the user's great interest in the new feature — according to aggregators, the number of mentions of Emoji Stake in Russian-speaking and English-speaking Telegram channels over the past few weeks has been in the tens of thousands.
Against the background of such interest, dozens of both publicly available and closed groups and channels have already appeared, as well as bots with similar names — EmojiStacks, EmojiSake and others, Evgeny Balk, head of the Department of Development and Architecture at Cross Technologies, confirmed to Izvestia. The function of an internal casino where you can win cryptocurrency attracts the attention of those who want to make quick money, and, accordingly, scammers who build their schemes around such desires.
— About 150-200 thousand people may become potential victims of fraudulent schemes around Emoji Stake. Their actual number depends on the final form of this game feature and its promotion by Telegram," added Evgeny Balk.
At the same time, experts recalled that not only fraudulent clones, but also any gambling on Telegram can lead to financial losses. Emoji Stake has the same risk as any gambling game, noted IT expert Sergey Pomortsev.
Interest in Emoji Stake can be used to steal not only money, but also user accounts. Since the beginning of 2026, BI.ZONE Digital Risk Protection specialists have recorded over 800 fraudulent sites aimed at hijacking a Telegram account, said Dmitry Kiryushkin, the head of the company. Among other things, hackers often create Telegram bots that supposedly offer free cryptocurrency. In most schemes, participants are asked to verify their account by entering authorization data — it is at this stage that the account is stolen.
In December 2025 and January 2026, there was also a wave of fraudulent offers involving investments in cryptocurrency. 701 fake websites were identified in various domain zones, including the Russian one.
Not just cubes and dice
Any built-in gambling (as in the case of Emoji Stake) or quasi-investment function instantly becomes a bait for intruders, and the native integration of crypto wallets into Telegram lowers the entry threshold and simplifies the work of fraudsters, explained Anton Nemkin, a member of the State Duma Committee on Information Policy, Information Technology and Communications, federal coordinator of the Digital Russia party project.
— The Emoji Stake scheme is developing according to the classic phishing scenario, but with a new wrapper. The user is sent a message from the "official bot" or in a thematic chat with the promise of "increased coefficients" or "early access". The link leads to a clone site or fake WebApp inside Telegram, where it is suggested to log in through a wallet. After that, the attackers gain control over the assets, and sometimes over the account itself," Anton Nemkin clarified.
At the same time, Emoji Stake cannot be considered as a simple mini‑game, it is an element of Telegram's strategic architecture, it actually transforms the platform into an integrated financial gaming ecosystem, says Dmitry Poida, an investigative analyst at AML/KYT provider Shard.
— Betting in TON disguised as throwing emoji dice will cause users to lose their subjective sense of the value of funds, which will increase their tendency to repeat bets and reduce their critical assessment of the financial consequences of their actions. As a result, a highly engaged audience will be formed with an emotional attachment to the platform, for which the economic damage ceases to be obvious," said Poida.
Other risks when using Telegram
Telegram continues to violate the requirements of Russian legislation regarding gambling, according to Roskomnadzor. The press service of the department told Izvestia that for failure to delete prohibited information, the site was brought to administrative responsibility in the form of fines totaling 130.6 million rubles.
Since 2017, the RCN, based on the decisions of the Federal Tax Service, has entered 2674 gambling websites and channels into the Unified Register of Prohibited Information. Izvestia also sent a request to the Federal Tax Service regarding the appearance of online casino functions in the Telegram messenger and their accessibility to citizens of the Russian Federation.
In 2025, 379 criminal cases involving Telegram were initiated in Russia, Igor Bederov said.
If we talk about the whole world, then, according to the ChainAnalysis report, the amount of damage from cryptocurrency crimes in Telegram in 2025 exceeded $17 billion. This happened due to the introduction of AI and technologies that allow you to impersonate another person. The number of such crimes has increased by 1,400% compared to 2024, Igor Bederov said.
According to Positive Technologies, at the beginning of 2026, fraudulent schemes with the TON currency remain among the most numerous.
— For example, investment scams are distributed that promise earnings or no commissions when converting TON and USDT currencies into Telegram Wallet. Such schemes are promoted through social networks and Telegram channels with "free training" and "guaranteed income," and eventually lead to the theft of funds, accounts, and digital assets, including NFT gifts," Anna Golushko, senior analyst at Positive Technologies research group, told the editorial board.
In order not to fall for the tricks of hackers, Olga Altukhova, senior content analyst at Kaspersky Lab, recommends not clicking on links from questionable messages, especially if they were sent by strangers, and also not entering credentials and confirmation codes on suspicious resources. To protect against phishing, it is important to use a security solution, including on smartphones.
Переведено сервисом «Яндекс Переводчик»
