How do I prevent invite link leaks in a paid Telegram group?
Use an invite link that asks instead of admits. Telegram lets a link require approval, so every tap raises a join request, and a bot that approves only paying members makes a forwarded link useless: a stranger's request is declined and they never get in. If you use ordinary links instead, give each buyer their own link that holds one member at a time, revoke it when their access ends, keep the group private, and never share one permanent ordinary link for paid access.
Short answer
Use an invite link that asks instead of admits. Telegram lets a link require approval, so every tap raises a join request, and a bot that approves only paying members makes a forwarded link useless: a stranger's request is declined and they never get in. If you use ordinary links instead, give each buyer their own link that holds one member at a time, revoke it when their access ends, keep the group private, and never share one permanent ordinary link for paid access.
KickThemBot does the first for new Bouncers: each chat has one permanent request-to-join link, and the bot approves a request only for a member whose plan includes that chat. Everyone else is declined, and nobody declined is banned, so that link can be posted or forwarded without letting anyone in. You can switch a Bouncer to one-time links, which hold one member at a time and are revoked when the membership ends. An unused one-time link admits whoever taps it first, so the bot sends those privately and you should never post them.