Telegram founder Pavel Durov challenges hackers after security fix

Pavel Durov has a message for the hacking community: come and get me.

The Telegram founder and CEO publicly challenged people to break into his personal Telegram account, saying a security flaw reported in the app’s new widgets has been patched.

Telegram is pushing deeper into payments and crypto wallets. That makes any question about whether its features can be weaponized much bigger than a routine bug report.

What actually happened

Around November 9 to 10, 2026, Telegram rolled out HTML widgets for its Android and Windows apps.

The widgets power interactive features inside the messaging app, including payments.

On November 11, researchers at the security firm V12 demonstrated a proof-of-concept for a remote code execution (RCE) vulnerability tied to the widgets.

Telegram moved quickly. The company pushed a server-side patch to all users on November 11, within hours of the demonstration. A server-side fix lives on Telegram’s own infrastructure, so users didn’t need to update anything.

Then, on November 13, Durov weighed in personally. He pushed back hard on claims that the flaw let attackers compromise someone just by sending them a message. According to Durov, exploitation required an active third-party service to be initiated first. He argued the vulnerability did not exist in the form it had been described.

Telegram has said there were no confirmed exploitations or data theft linked to the reported flaw. No successful in-the-wild attacks tied to the issue have been reported.

The crypto stakes

Telegram’s expanding feature set now includes support for payments through newly integrated crypto wallets. The security incident coincided with more than 1 million new integrated wallets appearing within just 48 hours.

What this means

For Telegram, the immediate damage looks contained. The flaw was demonstrated, patched the same day, and no attacks have been confirmed.

The more interesting question is the dispute over severity. V12’s proof-of-concept framed the issue as a remote code execution risk. Durov argues it required a third-party service to be active first, which would sharply narrow who could actually be hit.

Durov’s dare is, in effect, a public stress test. If his account stays untouched, it’s a quiet point in Telegram’s favor. If someone succeeds, the company will have a much louder problem than a disputed bug report.