Your Telegram Group Just Got Raided. The 10-Minute Recovery Plan.

You open the chat and there are 40 new messages. Fake account names. Identical text or identical QR codes. Your regulars want to know what's happening, and you're about to start clicking delete.

Pause for 90 seconds. Close this in 90 seconds. Then run the sequence below in order.

I've watched this play out enough times across 48 Varta-protected communities to know two things: the panic step is what stretches the recovery from 10 minutes to a full afternoon, and there's a sequence that resolves it cleanly. Use it now, fix the root cause tomorrow.

The detailed how-to for each minute is below. Open the right one when you reach it; don't read ahead.

Minute 0–2 · Lock the group before you do anything else

Don't start deleting. Don't post "stop spamming". Don't respond in the chat. The raid is still in progress — every message you post gives the raiders a footprint to screenshot.

Open group settings → Permissions → toggle off "Send Messages" for everyone. Telegram's official moderation overview documents all built-in admin controls. Whole group is read-only for the next 8 minutes. This stops the flood mid-sentence.

If you can't lock (private group, you're not owner) — skip to Minute 2 and do Aggressive mode instead.

Minute 2–4 · Bulk-delete the flood, not one message at a time

Long-press the first raid message → "Select". Tap through the raid messages — Telegram lets you select up to 100. Tap the trash can → "Delete for everyone". Done in 60 seconds.

If you have more than 100 raid messages, repeat. Don't try to be surgical here — if it's obvious raid text (identical phrasing, fresh accounts, dump posted within the same 2-minute window), delete it. You can restore a legitimate message later; you can't restore your community's trust in real time.

Minute 4–6 · Ban the ringleaders, not just the messages

Open each raid account (tap the name). Check: account age, profile photo, other groups in common. A ringleader is usually 1–3 days old, no photo, posting first. Ban them permanently, not mute.

If your bot supports cross-group reputation (Varta does), banning them in one group automatically flags them across all your other groups. If you're on Combot or a keyword bot, you'll have to ban them in each group separately.

One shortcut: if they posted from the same link or crypto address across multiple accounts, the accounts are almost certainly the same ring. Ban all of them — even if some look "less guilty" than others. In raid forensics, "less guilty" usually means "more experienced".

Minute 6–8 · Tell your regulars what happened (in DM, not the chat)

Open a DM with your most active admin or moderator. Short message: "We had a raid. I've locked the group, deleted X messages, banned Y accounts. Unlocking in 2 minutes."

Don't post this in the group. The raid already caused panic; posting a recovery play-by-play extends the attention. When you unlock, just unlock. Your regulars will notice the chat went briefly quiet and will figure out what happened from context.

If members DM you asking what happened — respond privately, honestly, briefly. "Coordinated raid. Handled. Nothing leaked, nothing you need to do." That's it.

Minute 8–10 · Turn on Aggressive mode + add an AI bot if you don't have one

Group settings → toggle "Aggressive anti-spam". This is Telegram's built-in filter that catches the lowest tier of repeat-offender accounts. It's a minute of setup; you can turn it off later if it flags too much.

If you don't have an AI moderation bot yet, this is the moment to install one. Not because "AI solves everything" — because raids are exactly the pattern AI catches best: coordinated messages from fresh accounts with similar text or images, posted within a short window. Test it yourself — paste a raid message, see what happens in 3 seconds.

Unlock the group. You're done.

Prevent the next one

Raids don't happen randomly. They happen because someone mapped your group as reachable — public invite link, listed in a directory, cross-posted from a different raided group. Three durable fixes:

1. Restrict new-member posting. Group settings → new members can't send links, forward, or media for their first 24 hours. Most raiders use fresh accounts; they'll fail the 24h check before they can post anything.
2. Rotate your invite link weekly. If you're sharing the public link in Twitter/Reddit/threads, regenerate it every Monday. The old link becomes dead; anyone who saved it for a future raid is cut off.
3. Add cross-group intelligence. This is the one thing keyword bots can't give you. If a spammer has been banned in two other Telegram groups for similar behavior, your bot should already know before their first post in yours. Varta does this automatically across all its protected groups.

What not to do

I've watched admins make these mistakes in the heat of a raid; each one prolonged the damage.

• Don't lecture in the chat. "Please stop spamming" is a gift to raiders — it shows them you're reading, you're rattled, and you've broken your own posting-quality policy. Ignore, delete, ban.
• Don't just mute, always ban. Muted accounts come back when you forget. Banned accounts stay gone.
• Don't post a "sorry for the spam, back to normal" message. You didn't cause this; you handled it. Drawing attention to it gives the raiders exactly the amplification they were after.
• Don't DM your whole member list to apologize. Mass DMs from an admin account look like spam to Telegram's anti-abuse system. You might rate-limit yourself for 24 hours.

Varta is the Trust Layer for Telegram — AI in 33 languages, cross-community reputation across 48 protected groups, image vision, never posts in your group. Free to add; the 5-day AI trial starts only when Varta catches your first spam. Install in shadow mode — watch before it acts →