《How My Telegram Account Got Hacked on My Birthday》 《TG账号如何在生日当天被盗》 I. Incident Review On the night of January 27, 2026, my @Evelyn_XYF account was unexpectedly logged out on three devices. At first, we considered two possible reasons: A. Telegram’s internal risk screening for users in certain restricted regions in Asia; B. Network issues (such as Wi-Fi not supporting VPN nodes). Since this account was activated at the end of 2023 and linked to my personal phone number, I’d never had an issue with logging out before. Plus, my Telegram account is closely tied to my personal phone number, which requires a verification code to log in. When the incident occurred, the account was successfully logged into three devices with no signs of abnormalities. However, around 11:00 PM on January 28, 2026, the account logged out again. When I tried to log in multiple times, Telegram showed a prompt asking mainland China users to pay an SMS fee (for non-Premium accounts). But since @Evelyn_XYF is a Premium account, this message should not have appeared. This clearly indicated that my phone number had been changed, confirming that my account had been hacked. That night, when I logged in again using the same phone number, it turned out to be a brand new Telegram account. Clearly, the hacker had already changed the phone number linked to @Evelyn_XYF. To this day, the hacker is still using my account, reading and replying to group messages, and even deleting the security reminder "The @Evelyn_XYF account has been hacked, do not respond" from the group chats. II. Pre-existing Security Measures Account hacks are common, and I’m quite familiar with phishing, hacker attacks, and vulnerability exploits. That’s why I had already implemented the following security measures on my main account: 1. Enabled 2FA (Two-Factor Authentication); 2. Linked both my phone number and email to the account. III. Possible Causes 1. Clicking on External Links: I’ve always been cautious about Zoom meeting links, but I never thought Calendly links would also become a hotspot for phishing attacks. 2. Multiple International/Regional Community Connections: The account information might have been exposed through links or improper sharing of information within various community groups. IV. Potential Losses and Impact 1. Exposure of Sensitive Team Information and Personnel Data: This could result in the leakage of important project details, strategies, and other confidential information, damaging team security and trust. 2. Google Account and Unarchived File Security Risk: Files that weren't backed up or encrypted on time could be leaked after the hack, compromising both personal and team documents. 3. Risks from Centralized Group Chat Management: Since all the management permissions for the group chats were tied to one account, it’s much harder to clean up or control access after the account is compromised. 4. Ton Wallet Asset Risk: Since the wallet wasn’t encrypted or didn’t have two-factor authentication, there’s a risk that wallet assets might be stolen. V. Lessons Learned and Preventive Measures 1. Account Security: Always strengthen your password management by using more complex passwords and changing them regularly. Even with your most-used accounts, it’s important to keep them secure. 2. Ensure Higher Security for Multi-device Syncing: When syncing across multiple devices, enable higher levels of security to prevent insecure devices from gaining access. 3. Treat Any Suspicious Logins or Logouts as a Final Warning! Immediately end the session and re-authenticate if there are any signs of suspicious logins or logouts to prevent hackers from exploiting an already logged-in session. 4. Group Chat Management: Distribute management permissions to prevent a single account from being responsible for all group chats. This reduces the potential damage if an account gets hacked.