Telegram Account Hacked? How to Recover It and Lock Out the Attacker (2026)
Forced sign-outs, scam links sent under your name, a cloud password that suddenly fails—scary, but if you still control the phone number, most accounts can be taken back in minutes. Order matters.
Terminate unknown sessions first, reset the two-step cloud password next, then reclaim login with your phone number. When the number is yours and the attacker has not replaced your cloud password, recovery usually works. Faster action means less spam damage and fewer lost admin rights.
Which “hacked” case are you in?
| Symptom | Likely meaning | Urgency |
|---|---|---|
| Still signed in; stranger device listed | Attacker online, you still hold the app | High — kick sessions now |
| Forced offline | Sessions being reset against you | High — request a code |
| Contacts got messages you did not send | Account used for scams | High — reclaim, then clarify |
| Cloud password rejected | Password may have been changed | Critical — recovery email |
| Phone number also changed | Deep takeover | Critical — odds drop |
Still in / locked out: the golden order
Disconnect them, lock the door, confirm only you hold the keys.
- Terminate all other sessions if the app still opens: Settings → Devices
- Reset two-step with your recovery email
- If signed out: official client + phone code; if they changed the cloud password, use Forgot password / recovery email
- Delete scam messages, check username/photo, leave odd groups
- Remove modded “turbo” clients; reinstall from the download page
Login mechanics: login guide. Recovery email path: two-step. No email usually means a ~7-day wait while the attacker may still be active.
After scam spam: money and groups
Withdraw scam messages, warn contacts, report; use SpamBot if limited. Crypto already sent is almost never reversible via Telegram. Groups/channels with other admins can remove the hijacked account; a sole-admin channel that is fully lost usually must be rebuilt—keep backup admins beforehand.
Harden after recovery—and when to stop
| Action | Purpose |
|---|---|
| Two-step + recovery email | Block SMS-only takeover |
| Passkeys / passcode | Less SMS dependence; local lock |
| Hide phone number | Fewer social-engineering leads |
| Official clients only | Avoid session-stealing mods |
| Regular Devices checks | Catch strangers early |
Also review phishing, QR safety, passkeys, and hiding your number.
| State | First move | Do not do first |
|---|---|---|
| Still signed in | Terminate other sessions | Post warnings while they stay online |
| Kicked out | Official client + phone code | Type codes on external pages |
| Cloud password changed | Recovery email / official reset | Send a new code to “support” |
| Recovered, Devices clean | Harden, then stop | Mass-spam explanations to every chat |
FAQ
Can a hacked Telegram account be recovered?
Usually yes. As long as you still hold the bound phone number and the attacker has not changed your two-step cloud password, you can request a new login code, reclaim the account, then terminate their session and reset the cloud password. If they already changed the cloud password and you have no recovery email, recovery becomes much harder.
Someone is logged into my Telegram — what is the first step?
The first step is to terminate unknown sessions, not to change a password. Open Settings → Devices and tap “Terminate All Other Sessions” to kick them offline, then reset the two-step cloud password. If you reverse the order, the attacker may still be online and see your actions.
My Telegram two-step password was changed by someone else. What now?
If you set a recovery email earlier, tap “Forgot password” on the cloud-password screen and reset it via email. Without a recovery email, Telegram will not manually bypass the cloud password for security reasons; you must wait out the system reset period (usually 7 days) and reset via phone code, during which the account may stay compromised.
If my account is gone for good, can the money or groups be recovered?
Be realistic: crypto sent during a scam is effectively irreversible — Telegram cannot reverse a transfer. For groups and channels, if another admin still has rights, they can remove the compromised account; but if the only admin account is lost, you usually have to rebuild. This is why two-step verification and multiple admins matter beforehand.
Contacts already got scam messages from my account — how do I clarify?
After reclaiming: delete suspicious messages; post a short note in relevant chats (account was compromised, don’t click links, don’t send money); DM key contacts if needed. Also confirm all unknown sessions are gone and the cloud password is reset so the attacker cannot come back and keep messaging.
Why is “change password before kicking sessions” the wrong order?
If the attacker is still online, they may see your Settings changes in real time — or race you to change profile data or open new sessions. Kill “Terminate All Other Sessions” first to cut access, then reset the cloud password and clean the profile. Reversing the order slows containment.
I was kicked out but still have the phone number — what’s step one?
Sign back in on an official client with the SMS/app code, then immediately terminate every other session, reset the two-step password, and check profile / outbound scam messages. Don’t hire “recovery brokers” or scan unban QR codes.
After reclaiming, should I notify contacts?
If the attacker messaged scams or payment requests, clarify in those chats/groups quickly and tell people not to open old links. Report related accounts and check @SpamBot if the account may already be limited.
The cloud password was changed too — can I still reclaim with the phone number?
Usually yes via phone login/reclaim; if a recovery email exists, reset the cloud password through official flows. Still terminate unknown sessions first, then reset two-step — same gold order as the article; don’t type codes on external pages.
Should I change username and photo the same day I reclaim?
Yes, soon: it reduces the chance contacts keep trusting a hijacked look or old phishing posts. Pair it with Devices review and two-step, after notifying anyone who got scam messages.
Need the installer or platform notes?
The download page lists versions, requirements, and install entry points.
Open download page