The Conspiracy Money Machine: Uncovering Telegram's Conspiracy Channels and their Profit Model

Conspiracy communities are usually studied as a content problem. This paper studies them as an economic one: who gets paid, through which infrastructure, and how much.

Venue

USENIX Security 2025

Type

Conference paper (peer-reviewed)

Status

Published

Role

Measurement pipeline, data engineering, analysis

Research question

How is the conspiracy ecosystem on Telegram monetized, and can the flow from community to revenue be measured end to end rather than inferred?

Method

We built a measurement pipeline that follows the path from Telegram communities out to the open web: channel discovery and collection, message parsing, URL extraction, and resolution of the destinations those URLs lead to, preserving provenance at every hop, so any figure in the paper can be traced back to the message it came from.

Findings

The monetization does not run through the platforms most moderation work focuses on. It runs through ordinary web infrastructure – storefronts, payment processors, donation platforms, and affiliate links – reached from communities that themselves host no transaction. Measured end to end, that ecosystem accounts for approximately USD 71 million.

Engineering contribution

The study required infrastructure before it could require analysis: collection at a scale where retries, duplicates, and partial failures are the normal case; a schema that separates observed data from derived facts; and a pipeline that can be re-run to reproduce any figure. I have written about the infrastructure behind it separately.

Limitations

The measurement covers public channels observed during the study window and destinations reachable from them. It does not generalize to private groups, and revenue figures are lower bounds constrained by what is publicly observable.

@inproceedings {307696,
  author = {Vincenzo Imperati and Massimo La Morgia and Alessandro Mei and Alberto Maria Mongardini and Francesco Sassi},
  title = {The Conspiracy Money Machine: Uncovering Telegram{\textquoteright}s Conspiracy Channels and their Profit Model},
  booktitle = {34th USENIX Security Symposium (USENIX Security 25)},
  year = {2025},
  isbn = {978-1-939133-52-6},
  address = {Seattle, WA},
  pages = {5229--5246},
  url = {https://www.usenix.org/conference/usenixsecurity25/presentation/imperati},
  publisher = {USENIX Association},
  month = aug
}