Telegram users on Monday found that every shortlink beginning with ‘t.me’ had disappeared from the internet. The outage disrupted group invitations, profile sharing, and channel links for nearly a billion people, leaving many unable to access key parts of the platform.
A technical failure did not cause this widespread outage. Instead, it resulted from an unexpected consequence of a United States government effort to disrupt a cybercriminal proxy network.
On July 13, the US Treasury Department’s Office of Foreign Assets Control (OFAC) imposed sanctions on the administrators of First VPN Service (1VPNS), aiming to disrupt infrastructure used by ransomware groups. First VPN had promoted itself as offering complete anonymity, which drew the attention of law enforcement agencies.
As part of these sanctions, the Treasury released a list of related web addresses. Among them was a link to First VPN’s public support channel on Telegram.
Domain registrars are required to follow international regulations. Identity Digital, which oversees the technical operations for the .me domain, confirmed that the t.me domain was blocked following a request from OFAC.
However, registries cannot selectively turn off a specific channel path; consequently, the Montenegro-based registry Domain.Me applied a “serverHold” status to Telegram’s entire t.me domain, effectively erasing it from the global Domain Name System (DNS).
READ MORE: GTA 6 hacker Arion Kurtaj moved to regular prison ahead of retrial
While the core messaging app continued to function smoothly, the platform’s shortlinks went entirely dark.
Telegram CEO Pavel Durov, not initially aware of the domain hold, publicly requested that the registrar look into the issue.
After the sanctions issue was identified, Telegram removed the channels in question. The registry operator confirmed compliance and restored access to the t.me domain.
“A Telegram channel using the t.me domain was among 1VPNS identified infrastructure. Accordingly, the t.me domain was suspended,” Domain.Me confirmed, adding that normal service resumed after Telegram removed the affiliations.
This incident highlights a significant vulnerability in the way the internet is managed. The suspension of a single sanctioned URL was enough to disrupt a vital communication tool for millions of users worldwide.