# Are Telegram mini apps safe? What a mini app can do > What a crypto mini app can reach, what Telegram's documentation says it cannot, and four checks before you open one with your wallet connected. "Are Telegram mini apps safe" is the question the tap-to-earn wave left behind, and it now trails every mini app in crypto, including the ones that run inside Cherry. A mini app is a web page that opens inside a chat with your wallet already attached to it. Being a web page, it holds no keys and it signs nothing by itself. Cherry is a wallet-to-wallet messenger for crypto: you sign in with a wallet, DM any address, and join token-gated, NFT-gated and paid group chats. This page covers what a mini app is allowed to touch, what it can never touch, and the four checks that separate a registered app from a link a stranger pasted. You need a Solana wallet connected to Cherry on the web app or the mobile app; nothing else. ## Are Telegram mini apps safe? The container is sandboxed; the risk sits in what you approve inside it. Telegram's own documentation describes mini apps as JavaScript interfaces launched inside Telegram that "can completely replace any website", and it is blunt about the limits. Inline mini apps "have no access to the chat", and "they can't read messages or send new ones on behalf of the user". A mini app receives basic account information, listed there as ID, name, username and language code, and it has to ask you through a dialog for anything past that: write access, contact details, location, biometrics. That is still how the documentation reads as of September 2026. Scams work around those limits, not through them. BleepingComputer reported on 3 May 2026 that the security firm CTM360 had documented a fraud network it called FEMITBOT: fake mini apps dressed as Apple, MoonPay, NVIDIA and other known brands, fabricated account balances with countdown timers, deposit and referral prompts, and Android installer files pushed under the names of real broadcasters and chip makers. None of that needed a flaw in Telegram. It needed a user who believed the screen in front of them. So the honest answer is about approvals. A mini app is a stranger's website with a button that talks to your wallet, and the question worth asking is what it wants you to sign. ## What a crypto mini app is allowed to do The permissions are declared when the app is registered, and the list is short. A mini app on Cherry can connect to your wallet, ask you to sign a message or a transaction, ask you to sign and send a transaction, open a Cherry profile or a room, and render itself as a card inside a chat. The room's messages are not on that list. What the app is handed is your wallet address, your display name and avatar, and the room's title and member count. The set is decided each time you open the app. The same mini app gets a narrower set of permissions in someone else's room than in the room its own team runs. Everything else is ordinary web code in an ordinary container: a WebView in the mobile app, an iframe on the web. Your keys stay in your wallet, and the app sees only what it was handed. It cannot move a single lamport without a signature that came from your wallet. More on how that works sits on the [mini apps feature page](https://cherry.fun/learn/features/mini-apps/) and in the short definition of a [crypto mini app](https://cherry.fun/learn/glossary/crypto-mini-app/). ## Step 1: Open the app from its own room Registered mini apps on Cherry live in rooms of their own. Cherry loads a mini app only from the web address its builder registered, so a URL pasted into a chat cannot render as a mini app inside Cherry. It opens in your browser as a plain web page, with no wallet handed to it and no Cherry identity behind it. [SOL Miner on Cherry](https://chat.cherry.fun/@solminer) You know you are in the right place when the app opens inside the room, under the room's name, and the room has a handle you can type: chat.cherry.fun/@solminer reaches the same mining game every time, whatever a message in some other chat claims. ## Step 2: Read the room before you open the app Every public Cherry room has a page of its own showing the member count, the description, the gating rules, the rating and member reviews. Read those before you tap anything. Rooms with real use show it in those numbers: as of September 2026, Jupiter Swap had 936 members and the Polymarket prediction markets mini app 733. [SOL Reclaim on Cherry](https://chat.cherry.fun/@solreclaim) A room opened yesterday, holding a handful of members, with a name one character away from a famous one, is the shape of a fake. The member count, the description and any ratings belong to the room itself, and a fresh imitation starts with none of them. ## Step 3: Notice the first thing it asks for A game that wants a signature before it has shown you a screen is telling you what it is for. Opening a mini app is free and reversible, and nothing has left your wallet at that point. The first signature request is the real entry, and it deserves the same attention you would give a swap on a site you have never used. Ask what the request buys you. A message signature that proves you own the wallet is cheap and common. A send request that moves tokens should match something you asked the app to do, in the amount you expected, on the token you expected. ## Step 4: Read the wallet screen In the Cherry web app, a signature request that arrives without a tap from you first raises a confirmation step, headed "Approve transaction", "Approve and send transaction" or "Sign message" depending on what was asked. Under it sits a button naming your wallet, "Open Phantom" for Phantom, next to "Cancel". That step is a handoff. The detail lives on the wallet's own screen: the amount, the token, the destination, the program being called. Cherry never holds your keys and never signs for you, which is the same thing as saying the last decision is always yours. Cancelling costs nothing. An app that responds to a cancelled signature by asking again, worded more urgently, has answered the safety question for you. The same habit applies outside mini apps, which is the subject of [connecting your wallet to a site you do not know](https://cherry.fun/learn/guides/is-it-safe-to-connect-your-wallet/). ## What still goes wrong Two failures, and both are human. The first is the lookalike: a member pastes a link in a busy chat, it carries a familiar logo and a countdown, and somebody opens it in a browser and connects a wallet there. Cherry's registration check protects what runs inside Cherry; it cannot protect a tab you opened yourself. The second is the approval read at speed. A transaction signed in a hurry, in a room where twenty people are posting about a claim, is the one nobody reads. Slow down at the wallet screen. Everything before it is reversible; nothing after it is. ## Related guides - [Spot a fake airdrop](https://cherry.fun/learn/guides/spot-a-fake-airdrop/) covers the claim-page version of the same trick. - [Check whether a crypto Telegram group is official](https://cherry.fun/learn/guides/is-a-crypto-telegram-group-official/) covers the room the link arrived in. - [Trading in chat](https://cherry.fun/learn/features/trading-in-chat/) explains the swap flow a real in-chat trade uses. ## FAQ **Are Telegram mini apps safe?** The container is sandboxed. Telegram's documentation says inline mini apps cannot read a chat or send messages on your behalf, and anything beyond basic account details has to be requested in a dialog. The losses come from what people approve inside a mini app, not from the app reading something it should not. **Can a mini app steal my crypto?** Only if you sign something that moves it. A mini app holds no keys and cannot send a transaction by itself. It can ask your wallet, and your wallet shows you the amount and the destination before you approve. **What permissions does a crypto mini app have?** On Cherry a mini app can connect to your wallet, ask you to sign a message or a transaction, ask you to sign and send a transaction, open a Cherry profile or room, and render as a card inside a chat. The room's messages are not part of that list. **How do I tell a real mini app from a fake link?** A real one has a room of its own with a handle, a member count, a description and, where members have left them, reviews you can read before you open it. A link pasted into a chat opens in your browser as an ordinary web page, and Cherry will not run it as a mini app. **Where do crypto mini apps actually run?** In a WebView inside a mobile app and in an iframe on the web. Both are ordinary browser containers, so a mini app is a web page with your wallet handed to it. Open a mini app the safe way: join its room at [chat.cherry.fun](https://chat.cherry.fun), read the page, then tap. ## Sources - [Telegram Mini Apps documentation](https://core.telegram.org/bots/webapps) - [BleepingComputer on Telegram mini apps abused for crypto scams, 3 May 2026](https://www.bleepingcomputer.com/news/security/telegram-mini-apps-abused-for-crypto-scams-android-malware-delivery/) - [SOL Miner on Cherry](https://chat.cherry.fun/@solminer) - [Polymarket prediction markets on Cherry](https://chat.cherry.fun/@predict)