The Conspiracy Money Machine: Uncovering Telegram's Conspiracy Channels and their Profit Model

Conspiracy communities are usually studied as a content problem. This paper studies them as an economic one: who gets paid, through which infrastructure, and how much.

Venue

USENIX Security 2025

Type

Conference paper (peer-reviewed)

Status

Published

Role

First author; measurement pipeline, data engineering and analysis

Research question

How do conspiracy channels on Telegram direct users toward monetization services, and what can publicly observable campaign and platform data establish about the money involved?

Method

We built a measurement pipeline that follows the path from Telegram communities out to the open web: channel discovery and collection, message parsing, URL extraction, and resolution of the destinations those URLs lead to. The pipeline extracted 205 million URLs and preserved the links between source messages, web observations and derived results.

Findings

The monetization does not run through the platforms most moderation work focuses on. It runs through ordinary web infrastructure – storefronts, payment processors, donation platforms, and affiliate links, reached from communities that themselves host no transaction. Linked crowdfunding campaigns report nearly USD 71 million raised. This is not a measurement of how much each channel earned or proof that every contribution originated on Telegram.

Engineering contribution

The study required infrastructure before it could require analysis: collection at a scale where retries, duplicates, and partial failures are the normal case; a schema that separates observed data from derived facts; and a pipeline that can be re-run to reproduce any figure. I have written about the infrastructure behind it separately.

Limitations

The measurement covers public channels observed during the study window and destinations reachable from them. It does not generalize to private groups. Financial estimates depend on publicly observable platform data; the study cannot quantify every revenue stream or attribute every campaign contribution to Telegram exposure.

@inproceedings {307696,
  author = {Vincenzo Imperati and Massimo La Morgia and Alessandro Mei and Alberto Maria Mongardini and Francesco Sassi},
  title = {The Conspiracy Money Machine: Uncovering Telegram{\textquoteright}s Conspiracy Channels and their Profit Model},
  booktitle = {34th USENIX Security Symposium (USENIX Security 25)},
  year = {2025},
  isbn = {978-1-939133-52-6},
  address = {Seattle, WA},
  pages = {5229--5246},
  url = {https://www.usenix.org/conference/usenixsecurity25/presentation/imperati},
  publisher = {USENIX Association},
  month = aug
}