Tldr: they don't know the official reason, the article is just speculation. But they think it was an error, it wasn't intended againt telegram
OFAC published a Recent Actions entry dated July 13, 2026, the same day the serverHold status appeared, titled “Cyber-related Designations; Cuba Designations; Issuance of Cuba-related Frequently Asked Question.” [...] Buried in that same entity list is the actual connection: FIRST VPN SERVICE, also known as 1VPNS or FVPNS, a Dnipro-based operation OFAC designated under the CYBER4 program. The SDN entry lists its identifying infrastructure, including several standalone websites (1vpns.com, 1vpns.net, 1vpns.org, 1jabber.com) and one more entry alongside them: an alternate website listed as t.me/FirstVPNService. [...] To be clear about where the evidence stops: OFAC’s own filing does not mention t.me, the serverHold status, or Telegram at all. Nobody at Treasury, Identity Digital, doMEn, or Telegram has confirmed this is the actual trigger.