From Telegram to Discord: How Crypto Scams Funnel Victims Step by Step
Cryptocurrency scams rarely start with “Send me money.”
Instead, they unfold as a carefully staged social funnel, designed to build trust, create urgency, and isolate victims before the financial hit occurs. One of the most common modern patterns is the Telegram → Discord pipeline. Understanding this flow is crucial for identifying red flags early, before significant losses occur. Don’t be locked into Telegram or Discord though, the idea is that a more public and accessible channel is the lure to a more private space.
The same sequence repeats across hundreds of scams, often run by overlapping networks using recycled infrastructure. Understanding that sequence gives investigators something more valuable than wallet addresses: footholds.
1. The Initial Hook: Where the Net Is Cast (Telegram)
The scam almost always begins in a place the victim already trusts. Telegram is ideal: crypto groups, trading channels, and public discussions provide cover. A message appears, sometimes direct, sometimes through a group invite.
The pitch is intentionally vague:
“Private trading signals”
“Early access opportunity”
“Invite-only investor group”
Nothing concrete. Nothing verifiable. Just enough to spark curiosity.
Why it works:
People confuse presence with legitimacy. If others are there, it must be real.
OSINT footholds at this stage
Telegram usernames reused across groups or time
Profile photos reverse-searchable across platforms
Invite links that expose creation dates and reuse patterns
Language patterns (scripted phrasing reused verbatim across scams)
This is often the earliest and richest evidence point, before accounts are burned.
2. Trust Without Pressure: Grooming in Plain Sight
The next phase feels harmless. Conversations are friendly. The scammer talks about market trends, shares screenshots of supposed profits, and carefully avoids asking for money.
This isn’t restraint… It’s grooming.
Screenshots circulate. Testimonials appear. Someone casually mentions how much they made last week.
Red flag: Any mention of guaranteed or low-risk crypto returns.
OSINT footholds at this stage
Screenshot inconsistencies
Recycled images from older scams or stock sources
Sockpuppet accounts responding in predictable time windows
Time zone indicators from posting patterns
Here, analysts can begin cluster analysis of accounts that reinforce each other.
3. The Migration: Breaking Context (Telegram → Discord)
Once trust is established, the victim is nudged elsewhere.
“Telegram isn’t secure.”
“The real strategy is on Discord.”
“We keep serious investors there.”
This move is critical. Platform migration disrupts the victim’s sense of continuity and places them inside a space the scammer controls completely.
OSINT footholds at this stage
Discord invite links (often reused across multiple scams)
Server creation timestamps that don’t match claimed history
Admin account ages are inconsistent with authority claims
Cross-platform username reuse between Telegram and Discord
This transition often exposes infrastructure reuse, a key investigative lever.
4. The Discord Illusion: Manufactured Reality
The Discord server looks alive. Channels overflow with “wins.” Bots announce profits. Members praise admins. Everything signals success.
In reality, most activity is scripted or automated.
Anyone who asks difficult questions disappears.
OSINT footholds at this stage
Bot activity patterns posting at regular intervals
Low entropy usernames generated in batches
Channel permission structures that suppress organic discussion
Message deletion logs indicating moderation abuse
This is where behavioral analysis becomes more useful than content analysis.
5. Authority and Obedience
Admins now occupy an unquestioned role. Instructions are direct and procedural:
“Copy this wallet.”
“Follow these steps exactly.”
“Don’t miss this window.”
The community reinforces compliance. Dissent is framed as ignorance.
OSINT footholds at this stage
Wallet addresses reused across campaigns
Instruction phrasing identical to prior scam playbooks
Admin role handoffs between short-lived accounts
Pinned messages revealing operational priorities
Authority here is theatrical and often hastily assembled.
6. The Ask: When Money Enters the Story
Only after trust, isolation, and authority are established does the scam reveal itself fully.
Victims are asked to:
Send crypto to a private wallet
Connect to a fake trading dashboard
Participate in “copy trading”
Critical rule: Legitimate investments do not require private wallet transfers.
OSINT footholds at this stage
Blockchain analysis (wallet reuse, laundering paths)
Fake dashboard domains with recent registrations
Hosting overlap with known scam infrastructure
SSL certificate reuse across fraudulent sites
This is often where technical OSINT overtakes social OSINT.
7. The Fake Win: Controlled Reinforcement
Some victims are allowed a small withdrawal. This is not profit; it’s bait.
The goal is psychological: override skepticism and encourage larger deposits.
OSINT footholds at this stage
On-chain inconsistencies between claimed and actual transactions
Simulated dashboards not reflecting blockchain reality
Withdrawal limits enforced selectively
This phase leaves fewer traces but reinforces earlier ones.
8. Escalation: The Fee Trap
When victims attempt larger withdrawals, obstacles appear:
Unlock fees
Taxes
Gas fees
Compliance charges
Each payment supposedly brings the funds closer. It never does.
OSINT footholds at this stage
Fee wallet clustering
Narrative shifts documented in chat logs
Template-based excuses reused across victims
This stage produces high-quality victim testimony, often the most detailed evidence.
9. Disappearance: The Burn
When payments cease, the operation comes to an abrupt end.
Discord server deleted
Admin accounts vanish
Victims blocked
Recovery is unlikely. Attribution becomes harder, but not impossible.
OSINT footholds after collapse
Cached Discord data
Telegram message remnants
Wallet transaction histories
Domain records and hosting breadcrumbs
Scams disappear quickly but rarely cleanly.
Key Takeaways for Investigators
Platform hopping is not incidental—it’s structural
Social proof is cheap and reproducible
Paying to withdraw is a definitive fraud indicator
Process repetition enables network-level analysis
You don’t stop these scams by memorizing wallet addresses. You stop them by recognizing the funnel.
Once you see the pattern, the infrastructure begins to take shape.
Learn more - check out our three-hour certificate course: Tracking Cryptocurrency Through Telegram
This content was developed in part using AI assistance from OpenAI’s ChatGPT (version GPT-5.2) and Google Gemini (version Gemini 3 Flash)