Short answer: a hacked Telegram account doesn't erase your Stars balance or Premium subscription — it hands control of them to whoever broke in. They can spend your Stars, gift them to another account, or send fake Premium-gift links to your contacts, and none of it can be undone. This falls outside any reseller's delivery guarantee, because the failure isn't delivery — it's account security. The fix that actually works is prevention: Two-Step Verification (2FA), set before anything happens.
What actually happens when the account is taken over
Once someone controls your Telegram account, Telegram treats every action they take as coming from you — there's no separate "hacked" state that blocks spending.
- The Stars balance gets spent. Settings → Stars shows the balance in plain view. It can be gifted to another account the attacker controls, or spent on a paid post or bot, in seconds.
- Premium gets used to scam your contacts. A common pattern: a message goes out to your entire contact list claiming "I gifted you a year of Premium, click here." Anyone who clicks loses their own account the same way — that's how it spreads.
- Any linked payment method is exposed. If a card or auto-renew is attached to the account, the attacker can buy more Stars or Premium and move it out before you notice.
This is a different problem from being scammed by a fake reselling bot. There, the mistake is picking the wrong service. Here, the account itself has been taken — the service you bought from is irrelevant.
How accounts actually get taken over
Almost none of this happens by guessing a password. It happens because someone gets the SMS login code.
| Method | How it works |
|---|---|
| Phishing page | A fake site styled like Telegram's login screen. Whatever code you type there goes straight to the attacker. |
| "Forward me the code" trick | A message, often from a compromised contact, says "I got a code by mistake, can you forward it" — it's actually your own login code. |
| SIM swap | The attacker convinces a mobile carrier to move your number to their SIM, so the SMS code arrives on their phone directly. |
| Session hijacking | Malware or an unattended Telegram Web session lets an attacker lift an active session token without ever seeing a code. |
If codes simply aren't arriving at all — a different, more common problem — see Telegram SMS code not arriving.
What to do in the first few minutes
- Terminate every other session. If you can still log in from any device, go to Settings → Devices and end all other sessions immediately. This removes the attacker on the spot.
- Set a new Two-Step password right away. Settings → Privacy and Security → Two-Step Verification.
- Check Stars and payment activity. Settings → Stars — an unexpected gift sent out or a purchase you didn't make is the clearest sign something happened.
- Warn your contacts. If the account was compromised even briefly, a fake message may already be sitting in dozens of chats. Tell people not to click it.
- Contact Telegram support if you're locked out. On the "Log in with SMS" screen, use "Report a login problem," or message @SpamBot directly — that's Telegram's own support channel.
One detail worth knowing: if you never set a Two-Step password, Telegram's own policy reopens the account to you automatically 7 days after a new device logs in, even without support intervening. With a 2FA password already set, that window can extend — which is exactly why setting it in advance matters.
Can stolen Stars or Premium be recovered?
Realistically, no. Telegram Stars purchases are final by design, and account compromise doesn't change that — from the system's point of view, the spend came from "you." The same applies to Premium activated or gifted away under your name.
This is also why a reseller's 100% guarantee — including StarsJoy's — applies specifically to an order that never got delivered (see is StarsJoy legit). If Stars or Premium arrived successfully and the account was compromised afterward through phishing or a SIM swap, that's outside what any delivery guarantee can cover — the failure happened after delivery, not during it.
Which is the whole argument for prevention over recovery: there is close to no recovery path once it's gone.
Setting up Two-Step Verification
- Open Telegram → Settings → Privacy and Security
- Tap Two-Step Verification
- Set a password you don't reuse anywhere else
- Add a recovery email — you'll need it if you ever forget the password
With this on, an attacker holding only your SMS code still can't get in — they need the password too. It's free, takes under a minute, and blocks the method behind most account takeovers.
Does buying Stars or Premium through a reseller put the account at risk?
Not when the reseller only asks for a username. StarsJoy works as a Telegram Mini App: delivery uses Telegram's own gift mechanism, triggered by nothing more than the recipient's public username. No password, SMS code, or account access is ever part of the transaction — so a purchase itself carries no exposure. The risk described in this article comes entirely from phishing, SIM swaps and session theft, not from buying Stars.
For the warning signs that do apply when choosing where to buy, see is buying Telegram Stars safe.
Related
- Telegram SMS code not arriving
- Is buying Telegram Stars safe? How to spot a scam
- About StarsJoy — what we are, and what we are not
Frequently asked questions
If my Telegram account gets hacked, will my Stars balance disappear?
It won't vanish by itself, but it becomes exposed. Whoever controls the account can spend the Stars or gift them to another account they own, and once that happens it cannot be reversed.
Does my Premium subscription get cancelled if my account is hacked?
The subscription itself isn't cancelled instantly, but an attacker can use Premium's capabilities under your name — for example sending fake 'I gifted you Premium' links to your contacts.
Can I get stolen Stars or Premium back?
Almost never. Telegram Stars purchases are final and not refundable, and that doesn't change because the account was compromised — the system sees the action as something 'you' did. A reseller's delivery guarantee only covers an order that was never delivered, not a later account takeover.
What's the fastest way to recover a hacked Telegram account?
If you can still log in from another device, go to Settings → Devices and terminate every other session immediately. If you're locked out and never set a Two-Step Verification password, Telegram reopens the account to you automatically 7 days after a new device logs in.
How does Two-Step Verification (2FA) actually help?
It adds a password on top of the SMS code. An attacker who only has your login code still can't get in without that password — this single setting stops most account takeovers.
Does buying through a reseller like StarsJoy put my account at risk?
No, as long as the reseller only ever asks for your public username. Delivery runs through Telegram's own gift mechanism — nobody involved needs your password, SMS code, or any access to your account.
Buy Telegram Stars or Premium in Uzbekistan
Pay in Uzbek som with Uzcard or Humo — no Visa card needed, delivered in about 10 seconds.
Open @starsjoybot