Set up security before you deposit

Every withdrawal has to be confirmed with your account PIN, so until you set one, no one — including you — can withdraw from the wallet. Setting security up takes a couple of minutes, and the most convenient moment is before your first deposit.

Everything below lives under More → Security.

1. Set your PIN (do this first)

The PIN is a 4–8 digit code, and it’s the primary security factor for withdrawals — every withdrawal has to be confirmed with it. Without a PIN you can’t withdraw at all.

Set it before your first deposit. While the wallet is empty, a new PIN takes effect immediately. Once the wallet holds funds, a newly set PIN waits before it activates in full — the wait is 24 hours — and during the wait it can still confirm withdrawals up to a small total allowance the screen shows, so an honest first cashout isn’t stuck, but someone who has just taken over your session can’t set their own PIN and drain the account. The app shows a banner with the exact activation time.

Details: your account PIN.

2. Add a backup email (optional, but do it)

The backup email has exactly one power: it lets you reset a forgotten PIN yourself, using a code mailed to that address. Without it, a forgotten PIN means going through support.

Adding it is confirmed by a code sent to the address. Note that if you later change the email, the new address waits out a cooldown before it can authorize a PIN reset — the cooldown is 1 hour — again, so a stolen session can’t just re-point your recovery channel.

Details: email verification.

3. Enroll biometrics (optional)

If your device supports Telegram’s biometrics, you can enroll Face ID or a fingerprint as a faster alternative to typing the PIN at confirmation time. You still need a PIN — enrolling biometrics is authorized with it, and biometrics never replace it.

Details: using biometrics.

4. Consider saving your withdrawal addresses

You can restrict withdrawals to addresses you’ve explicitly saved. Turning it on is instant; turning it off is deliberately delayed, so an attacker can’t disable it and withdraw in the same session.

Details: saved addresses.

Every change to these settings sends you a Telegram message. If one arrives that you didn’t trigger, act on it immediately.