Telegram's founder Pavel Durov has said a massive cyber attack on his messaging service originated from China.
On Wednesday, the firm confirmed it suffered a "powerful" Distributed Denial of Service attack which disrupted services for about an hour.
In a DDos attack, hackers overwhelm a target's servers with junk requests.
It came as protestors in Hong Kong used Telegram to coordinate demonstrations over a plan to allow extradition to China.
In a post on Twitter, Telegram said the disruption affected users in the Americas and "other countries".
Mr Durov later tweeted the IP addresses involved in the attack mostly came from China.
China's Cyberspace Administration, which oversees the country's cyber policy, has yet to comment.
Telegram allows people to send encrypted messages, documents, videos and pictures without charge.
Users can create groups for up to 200,000 people, or channels for broadcasting to unlimited audiences.
Its popularity has grown because of its emphasis on encryption, which thwarts many widely used methods of reading confidential communications.
Mr Durov's comments came amid reports a man identified as a Telegram group administrator had been arrested in Hong Kong for conspiracy to commit public nuisance.
Police and protesters had pitched battles in the city on Wednesday over plans to allow suspects to be extradited to mainland China.
Seventy-two people were injured, including two men who were in critical condition.
Hong Kong is part of China under a "one country, two systems" principle, which ensures that it keeps its own judicial independence, its own legislature and economic system.
People are worried that should the extradition bill pass, it would bring Hong Kong more decisively under China's control.