Telegram has numerous problems. The central one is their homebrew combination of cryptographic primitives with some very dubious choices (sha-1 based key derivation, sha-1+IGE used as a instead of an encrypt-then-MAC or some other standard AEAD mode of operation, weird factoring of integers as a proof of work system inexplicably tied to the crypto protocol, MITM vulnerabilities and a reliance on a trusted server... These choices are arbitrary, and their justification for all of these seems to be "trust us we've got this covered, nobody claimed our prize money yet".