Unveiling the Fake Virtual Number Scam on TON: A Showcase of Phishing Teams' Deceptive Tactics

Author: Fu Ruhe, Odaily Planet Daily

Recently, the development of the TON ecosystem has been thriving, with the ecosystem's TVL increasing by over 70% this month, reaching $260 million. However, the rapid growth of TON has also attracted the attention of phishing groups. Previously, community members reported discovering an extra "fancy number" (888 0505 0707) NFT in their TON wallets, but many community members found that transferring this NFT incurred a fee of up to 1 Toncoin (normally 0.02 Toncoin), and the NFT would reappear in their wallets after the transfer.

Currently, the TON ecosystem is filled with many "confusing" projects. Therefore, Odaily Planet Daily will review the development of virtual numbers themselves and the risks of such scams.

Phishing Teams Upgrade Their Tactics, Exploiting Low Costs and the Desire for Bargains

The "+ 888" series of virtual numbers was launched by Telegram on the Fragment platform in 2022, where the decentralized auction platform Fragment serves as an important witness to the thawing relationship between Telegram and TON.

Initially, the "+ 888" series virtual number NFTs were sold directly through Telegram at a price of 9 Toncoin. After selling out, buyers could either use them directly or resell them. The Telegram team originally aimed to provide a way for users with privacy needs through the auction of virtual numbers, thereby demonstrating Telegram's resistance to censorship.

Additionally, during this period, the relationship between Telegram and TON eased, leading to the launch of the Fragment auction platform based on TON, allowing virtual numbers to be auctioned in the form of NFTs.

Currently, Telegram has only launched the "+ 888" series of virtual numbers, which were initially intended for a privacy-seeking purchasing group but have shifted to become a symbol of identity. This phenomenon is similar to the demand for fancy phone numbers in the domestic market, prompting TON and Telegram users to auction coherent and auspicious numbers.

Data from the Fragment platform shows that the highest auction price for a virtual number is "+ 888 0666 0000," with an auction price of 1365 Toncoin (approximately $9,350). The next highest auction price belongs to the "protagonist" of this article (+ 888 0505 0707).

Phishing teams first created a fake NFT impersonating the virtual number (+ 888 0505 0707) at zero cost and distributed it through nftTONificatorBot, targeting active addresses on the TON chain. Users who frequently engage in on-chain activities may perceive this NFT as worthless and uncertain in safety, leading them to attempt to transfer the NFT with a skeptical mindset.

However, users discovered that the transaction fee for the NFT was as high as 1.02 Toncoin, and after completing the on-chain steps, the NFT remained unchanged in their wallets (isn't this reminiscent of wanting to uninstall 360 back in the day?). Some users, undeterred, attempted to transfer the NFT, but after paying 1 Toncoin each time, the NFT still remained in their wallets.

The above illustrates how phishing teams exploited users' skepticism about transferring NFTs to inflate the transaction fee to 1 Toncoin, while the NFT still stayed in the wallet. As for how to set the smart contract so that the NFT cannot be transferred or to use redirection to airdrop fake NFTs, no theoretical support has been found.

However, this novel phishing method can only deceive a small number of people. Therefore, the phishing team emulated the previous fake airdrop method on the X platform (formerly Twitter) by opening a minting page, allowing users to participate in the creation. This differs from the past airdrop claims, where users opened wallet permissions, leading to theft of funds; this time, the phishing team relied solely on users sending money themselves.

The author discovered that there are still users "sending money" to the phishing team's receiving address, transferring 1 Toncoin for a minting fee of 0.02 Toncoin. Currently, the phishing team is suspected of consolidating funds. According to tonscan data, the address UQB1QBhyiY76wtIDTaV3pFtl8jE_aCrlGeDDTRbz2LaNjTvH has received 6483 Toncoin in recent days, approximately $45,000. This address is just one of the many fund collection addresses. The total amount of the scam is likely to exceed $100,000.

Therefore, Odaily Planet Daily reminds everyone that although the TON ecosystem is developing rapidly and offering high returns, it is also a new battleground for phishing teams. Community members have reported multiple links to fake airdrops and fake NFTs, and we hope everyone enhances their risk awareness.