⚔️How Millions in Telegram Stars Got Stolen Before Payments Even Happened

➡️ Does your bot accept payments in Stars? This post is yet another reminder for everyone why documentation matters — and why extra validation is non-negotiable, especially when money is involved. 💸

ℹ️ A quick refresher on how Telegram payments actually work

🔗 core.telegram.org/bots/payments 🔗 core.telegram.org/bots/payments-stars

Here’s the normal payment flow:

0️⃣ User initiates a purchase 1️⃣ Telegram checks the user’s balance client-side: ▪️ If not enough — user is asked to top up ▪️ If balance is sufficient — the bot receives a pre_checkout_query 2️⃣ The bot must answer pre_checkout_query within 10 seconds, confirming it can provide the product/service 3️⃣ Payment is processed 4️⃣ Telegram sends the bot a successful_payment receipt

• “Sufficient” means either enough Stars OR the user pays by card — but at this stage Telegram has no idea whether the card actually has funds.

🎭 The twist: unofficial Telegram client + plugins

There’s an unofficial Telegram client called exteraGram, which supports custom Python plugins.

Some of these plugins allowed users to:

• Set any Stars balance they wanted
• Generate fake “successful payment” responses
• And, with a special mode enabled, auto-restore fake Stars after making a purchase

💻 A small excerpt from one such plugin’s source code

from org.telegram.tgnet.tl import TL_stars

StarsController = find_class("org.telegram.ui.Stars.StarsController").getClass()

class Plugin(BasePlugin):
    DEFAULT_BALANCE = 999999
    SETTINGS_INFINITE = "infinite_mode"

    def _handle_payment(self, response, error):
        # Create fake success response
        TL_payments_paymentResult = find_class("org.telegram.tgnet.TLRPC$TL_payments_paymentResult")
        TL_updates = find_class("org.telegram.tgnet.TLRPC$TL_updates")
        ...
        return HookResult(strategy=HookStrategy.MODIFY_FINAL, response=fake_result)

class _GetBalanceHook(MethodReplacement):
    def replace_hooked_method(self, param):
        # Return fake balance
        return self._create_stars_amount(self.plugin.balance)

    def _create_stars_amount(amount):
        return TL_stars.StarsAmount.ofStars(int(amount))

Of course, these “drawn” Stars cannot actually be used to complete legitimate payments.

They exist mostly for bragging rights — if your friends care enough to look. 😊

⚠️ The real issue: bots trusting pre_checkout_query

As it turns out, several bots — even those with tens of thousands of users — were not waiting for the successful_payment status.

Instead, they delivered goods/services immediately after receiving pre_checkout_query, ignoring Telegram’s documentation.

“The Stars are already on the table — what else is there to wait for?”

Well… a lot, actually.

💥 What happened next

Those who acted quickly emptied shops, purchased subscriptions, collected accounts and autorigs, and exploited services worth millions of Stars.

In many cases the bot operators suffered real monetary losses — LLM API calls, verification services, and other resources cost actual money.

Fortunately, many bot developers responded fast and mass-banned the abusers.

🛠️ Aftermath

Eventually, these plugins were published publicly — not to enable abuse, but to force developers (in a wake-up-call, stress-test fashion) to notice the holes in their systems and implement proper validation. ⚡️