Spam follows the same three steps
Watch a group for a week and the pattern repeats: an account joins, waits somewhere between four seconds and four hours, posts a link to a channel or a wallet, and disappears. Sometimes twenty of them join at once, minutes apart, with names that differ by a digit. Almost none of it is a person who read your rules and decided to break them.
That pattern is useful, because each step is a place to stop it, and stopping it early costs you nothing to maintain. The alternative is what most owners do instead: read the group at midnight and delete by hand, which works until the night you are asleep.
Layer one: make joining cost something
A CAPTCHA at the door asks the new member to tap a button or answer before they can post. It takes a human two seconds and stops the scripts that join a hundred groups an hour, because a script that has to think about your particular door is no longer cheap to run. This is the single change with the biggest effect, and it is on the free plan.
Set the timeout short. A newcomer who does not confirm within a minute or two was never going to say anything, and a long timeout leaves unverified accounts sitting in the member list where they still count as reach for whoever sent them.
Decide what happens on failure before you turn it on. Removing a failed join keeps the list clean; muting instead is gentler on the person who was on a train and lost signal halfway through. Both are defensible. Not choosing means the default decides for you.
Layer two: make the first message land nowhere
Most spam is a link. A link filter that holds or deletes links from members who joined recently removes almost all of it while leaving your regulars alone, because the account posting a wallet address has usually been in the group for under an hour. Restricting by account age rather than by content is what keeps the filter from catching your own people.
Add a word filter for the handful of terms that keep appearing in your particular group. Yours will not be the same as anyone else's, which is why a downloaded list works badly: it catches nothing you actually get and blocks three words your members use normally.
Anti-flood covers the other shape, where one account posts six times in ten seconds to push something off the screen. It is a rate, not a judgement about content, so it costs nothing in false positives.
Keep the word list short. A long list catches your own members mid-sentence and teaches them the group is unpredictable, and an unpredictable group is quieter than a slightly spammy one.
Layer three: warnings, then a ban
For the accounts that get through, warnings do the work you would otherwise do by hand: a first offence is a warning, a third is a ban, and the counter lives with the member rather than in your memory. That last part is what makes it fair. Without a counter, a ban depends on how well anyone remembers the last incident, and regulars notice when the same behaviour gets two different answers.
Raid protection covers the case where twenty accounts join in a minute. It tightens the door automatically until the wave passes, then loosens it again, and the useful part is that it happens at three in the morning without you.
Ban management keeps the record, so an account that returns under a new name and repeats itself does not get a clean slate it did not earn.
What to check after a week
Look at how many members you lost. A moderation setup that is too tight is invisible in the logs and expensive in the group: real people fail the CAPTCHA, get warned for a normal link, and quietly leave without arguing. Nobody files a complaint about a group that was mildly annoying.
If joins dropped and messages dropped with them, loosen the filter before adding another one. The goal is a group where the spam does not land, not a group where nothing lands.
What this costs
CAPTCHA and basic anti-spam are on the free plan, which is enough for one channel and enough to see whether the shape of your spam changes. The full moderation suite, with warnings, bans and the rest of the filters across up to three channels, is the $15/mo tier. Everything is a toggle in a web dashboard, and the bot reads group messages only to run the modules you turned on.