CoinTelegraph Twitter/X Phish TELE Fake Token Launch

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

CoinTelegraph Logo/Homepage

CoinTelegraph is a U.S.-based, globally active digital media outlet specializing in cryptocurrency, blockchain, and fintech news. The outlet recently suffered a security breach when its X account, with over 2.6 million followers, was compromised. Hackers used the verified account to run a phishing scam involving a fake link and spoofed website, tricking users into revealing login credentials, and promoting a fraudulent memecoin called TELE. Although CoinTelegraph quickly regained control and launched an internal investigation. There is no assistance provided to affected users who were tricked into purchases.

About CoinTelegraph

Founded in 2013, Cointelegraph is a privately held company specializing in cryptocurrency, blockchain, and fintech news. Cointelegraph is a leading independent digital media outlet. It delivers daily news, in-depth analysis, and educational content across various topics, including Bitcoin, Ethereum, decentralized finance (DeFi), non-fungible tokens (NFTs), and Web3. The platform is recognized for its comprehensive coverage, featuring expert opinions, price charts, and reports on the social impact of digital currencies.

Headquartered in the United States, Cointelegraph has expanded its presence internationally, with teams in over 30 countries. The company publishes more than 1,000 articles monthly and offers a range of resources, such as a mobile app, video content, and educational materials like "Cryptopedia" . Despite its prominence, Cointelegraph has faced criticism over the years for occasional inaccuracies and sensational headlines, which have led to discussions about its editorial practices within the crypto community.

In addition to its U.S. headquarters, Cointelegraph has expanded its global presence with offices in various countries, including China, Japan, South Korea, and the United Arab Emirates.

The Reality

Despite its prominence, Cointelegraph has faced criticism over the years for occasional inaccuracies and sensational headlines, which have led to discussions about its editorial practices within the crypto community.

This breach may indicate weaknesses in the account’s access controls, security monitoring, or incident response procedures, which allowed the attacker to maintain control long enough to disseminate deceptive content before the account was secured.

What Happened

CoinTelegraph's X account was briefly hacked and used for at least one phishing scam, as well as reportedly launching a TELE token.

Key Event Timeline - CoinTelegraph Twitter/X Phish TELE Fake Token Launch

Date	Event	Description
May 9th, 2025 9:06:00 PM MDT	The DeFi Edge Tweet	The Defi Edge posts a warning about a new social engineering scam involving the hacked @Cointelegraph X account, which sent a DM asking him to review an article supposedly involving his content. Despite recognizing the account as legitimate, he became suspicious when the link prompted an X login and revealed a typo-squatted domain, "Cointetegraph." He suspects the goal is to harvest login credentials and take over X accounts, urging others to stay vigilant.
May 9th, 2025 9:25:00 PM MDT	AInvest Article Published	AInvest reports that Cointelegraph's official Twitter (X) account was compromised on May 10, 2025, in a phishing attack that targeted crypto users through deceptive direct messages. The messages lured followers with a fake link claiming to relate to crypto influencer Edgy, redirecting them to a spoofed website named “Cointetegraph.” This site mimicked Cointelegraph’s branding to trick users into entering their X login credentials, potentially giving hackers access to victims’ accounts.
May 9th, 2025 9:50:00 PM MDT	PANewsLab Article Published	PANewsLab reports that Cointelegraph's official X account was suspected to be stolen, as it posted on-chain token contract tweets and shared fraudulent links with platform authors. According to crypto KOL @thedefiedge, the account sent him a private message requesting a review of an article, but the embedded link led to a fake domain ("Cointetegraph") designed to steal login credentials. The suspicious tweet had closed comments and has since been deleted.
May 11th, 2025 5:55:00 AM MDT	CoinTelegraph Security Notice	CoinTelegraph posts a security notice

Technical Details

This scam begins with the compromise of a high-profile, verified X (formerly Twitter) account—in this case, @Cointelegraph with over 2.6 million followers. Once attackers gain control of the account, they use its credibility to send direct messages to targets. These messages claim that an article has been published involving the recipient’s content, prompting them to click a link to review it. This appeal to ego and curiosity is a common psychological hook in social engineering attacks.

The link in the message leads to a phishing site that closely mimics the legitimate Cointelegraph domain but uses a subtle typo, such as “cointetegraph.com.” This tactic, known as typo-squatting, relies on the visual similarity of the fake domain to the real one to deceive the user. Once on the site, the victim is prompted to log in using their X credentials. The login page is a spoof, designed to harvest usernames, passwords, and potentially two-factor authentication codes.

Even if accessed in a private browsing window, the phishing site can still capture login data. After credentials are submitted, attackers can immediately access and potentially take over the victim's X account. They may even try to bypass two-factor authentication using real-time phishing techniques. The scam is particularly effective because it leverages the authority of a compromised trusted source, uses a well-crafted deception, and targets users' natural reactions to being mentioned in the media.

The attackers reportedly launched a memecoin TELE after sending private messages impersonating CoinTelegraph to trick others into compromising their password.

Total Amount Lost

There are limited specific details about the amount lost.

The total amount lost is unknown.

Immediate Reactions

Many community members acted to warn others to avoid purchasing the fraudulent token.

Ultimate Outcome

CoinTelegraph regained control of their account. There is no word on any assistance for users who were tricked into purchasing the coins.

Total Amount Recovered

There does not appear to be any attempt to assist any users who may have been affected by the incident.

There do not appear to have been any funds recovered in this case.

Ongoing Developments

The incident highlights a growing trend of social engineering in crypto-related cyberattacks, emphasizing the urgent need for vigilance, two-factor authentication, and skepticism toward unexpected links—even from trusted sources.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.