The latest articles on DEV Community by Abolfazl Mohammdi (@blockbuildlab). https://dev.to/blockbuildlab https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4231925%2F6d32135a-3a74-405d-9ce6-e7faeed7d4ee.png https://dev.to/blockbuildlab en Abolfazl Mohammdi Sat, 07 Nov 2026 12:01:13 +0000 https://dev.to/blockbuildlab/the-first-hour-after-a-token-launch-a-telegram-lockdown-checklist-4eoj https://dev.to/blockbuildlab/the-first-hour-after-a-token-launch-a-telegram-lockdown-checklist-4eoj <p>The first hour after a launch is when a Telegram group is most exposed: new members flood in, nobody knows who the real admins are yet, and scammers know it.</p> <p>This is the checklist I'd run, in order.</p> <h2> 30 minutes before launch </h2> <ul> <li>Pin one message with the real contract address and nothing else.</li> <li>Write the description: "Admins never DM first. The only CA is the pinned one."</li> <li>Remove every admin right you don't need. Only the owner can add admins.</li> <li>Set a captcha for new joiners.</li> <li>Block links and media from new members for at least the first hours.</li> </ul> <h2> At launch </h2> <ul> <li>Post the CA once, from the owner account, and pin it.</li> <li>Turn on slow mode for 10 to 30 seconds. It kills spam floods without killing the chat.</li> <li>Have one person whose only job is watching joins for names that copy admins.</li> </ul> <h2> When a raid starts </h2> <ol> <li>Raise slow mode.</li> <li>Restrict new members from posting.</li> <li>Pin: "Spam raid in progress. Don't click links. Admins never DM."</li> <li>Ban the raid accounts, then lower restrictions again.</li> </ol> <h2> After the first day </h2> <ul> <li>Review deleted messages so no real holder was silenced.</li> <li>Revoke old invite links.</li> <li>Keep the new-member link lock on; scammers come back on day two and three.</li> </ul> <h2> Automating it </h2> <p>Most of this can be automated. I built BlockGuard, a self-hosted bot that deletes any CA except yours, flags lookalike admin names (including Cyrillic/Greek letter swaps), locks links for new members, slows raids, and gives the owner one-tap Restore and Ban buttons. You can try to break it in the public demo group: <a href="https://t.me/blockguard_demo" rel="noopener noreferrer">https://t.me/blockguard_demo</a></p> <p>Questions about a specific setup: @Blockbuildlab1 on X.</p> telegram crypto security web3 Abolfazl Mohammdi Sat, 07 Nov 2026 10:50:08 +0000 https://dev.to/blockbuildlab/7-telegram-scams-that-hit-new-crypto-token-groups-in-the-first-48-hours-and-how-to-stop-each-one-5666 https://dev.to/blockbuildlab/7-telegram-scams-that-hit-new-crypto-token-groups-in-the-first-48-hours-and-how-to-stop-each-one-5666 <p>If you've launched a token, you've seen it: the Telegram group fills up, and within minutes the scammers arrive. Most of these attacks are boringly predictable, which is good news, because predictable attacks can be blocked.</p> <p>Here are the seven I see most often in small crypto communities, with a free fix for each.</p> <h2> 1. The fake contract address </h2> <p>Someone posts "CA: 0x..." or a Solana address that looks almost like yours. Buyers in a hurry copy the first address they see.<br> Fix: pin your real CA, tell members to only trust the pinned one, and use a bot that deletes any other contract address posted by non-admins.</p> <h2> 2. The lookalike admin </h2> <p>A new account joins with your admin's name and photo ("Dev | Support"), then DMs members offering help.<br> Fix: put "Admins will never DM you first" in your description and welcome message. Have a bot alert you when a new member's name closely matches an admin's, including Cyrillic or Greek lookalike letters.</p> <h2> 3. The "support" link </h2> <p>"Having trouble claiming? Validate your wallet here." This is wallet-drainer bait.<br> Fix: block links from brand-new members for their first hours, and delete messages that combine wallet words (seed, validate, claim, sync) with a link.</p> <h2> 4. The raid flood </h2> <p>Dozens of accounts join at once and spam emojis or the same message to bury real conversation.<br> Fix: captcha for new members, plus automatic slow-mode or join lock when joins spike.</p> <h2> 5. The "airdrop" announcement </h2> <p>A fake announcement for an airdrop or presale, often with a QR code image.<br> Fix: only admins can post announcements; delete forwarded "airdrop" posts from unknown channels.</p> <h2> 6. The DM-me recovery scam </h2> <p>"Lost funds? DM me, I can recover." Targets people who just got scammed.<br> Fix: a filter for recovery-scam phrases, and a pinned message saying no one in the group does recovery.</p> <h2> 7. The compromised mod </h2> <p>A real mod's account gets hacked and starts posting drainer links.<br> Fix: give mods only the permissions they need (no "add admins"), and keep an owner-only kill switch to restrict a mod fast.</p> <h2> What I built </h2> <p>I got tired of seeing the same seven attacks, so I wrote BlockGuard, a self-hosted Telegram bot (Python, aiogram) that handles these: it keeps your real CA as the only one allowed, alerts on lookalike admins, removes scam links and floods, and gives the owner one-tap Restore and Ban buttons so a wrong deletion is never lost.</p> <p>You can try to scam it yourself in the public demo group: <a href="https://t.me/blockguard_demo" rel="noopener noreferrer">https://t.me/blockguard_demo</a></p> <p>If you run a small project group and want help setting it up, reach me on X at @Blockbuildlab1. Even if you don't use my bot, the free fixes above will stop most of what hits a new group.</p> telegram crypto security python