Verify a decision

{"actor":"system:backfill","investigation_id":"1d62ae88-4b4d-4ccb-905a-a5a3badb9b77","kind":"publish","page_slug":"ton-blockchain","published_at":"2026-05-14T19:09:06.278Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"TON Blockchain","sections":[{"content":"In October 2019, the U.S. Securities and Exchange Commission filed an emergency action against Telegram Group Inc. and TON Issuer Inc. in the Southern District of New York (Case No. 1:19-cv-09439, before Judge P. Kevin Castel). The SEC alleged that Telegram had raised approximately $1.7 billion through two rounds of private presales of digital tokens called 'Grams' to 171 investors beginning in January 2018, constituting an unregistered securities offering in violation of the Securities Act of 1933. On March 24, 2020, Judge Castel issued a preliminary injunction preventing distribution of Gram tokens, finding the SEC had demonstrated a substantial likelihood of proving the sales formed part of a larger scheme to unlawfully distribute securities into the public market. Telegram abandoned the TON initiative in May 2020 and dropped its appeal on May 25, 2020. On June 26, 2020, the court approved a settlement under which Telegram agreed to return more than $1.22 billion to investors and pay an $18.5 million civil penalty. Telegram was additionally required to notify the SEC before participating in any digital asset issuance for three years. The network was subsequently relaunched by independent open-source contributors as The Open Network under the TON Foundation, formally distinct from Telegram but retaining deep commercial and technical integration with the Telegram platform.","heading":"SEC Enforcement Action and Origin (2019–2020)","severity":"high","sources":[{"credibility":1,"name":"SEC Press Release: Telegram to Return $1.2 Billion and Pay $18.5M Penalty","type":"regulatory","url":"https://www.sec.gov/newsroom/press-releases/2020-146"},{"credibility":2,"name":"CoinDesk: Telegram Agrees to Pay $18.5M Penalty in SEC Settlement","type":"news","url":"https://www.coindesk.com/policy/2020/06/25/telegram-agrees-to-pay-185m-penalty-in-sec-settlement-over-failed-ton-offering"},{"credibility":1,"name":"TechCrunch: Telegram to pay SEC fine of $18.5 million and dissolve TON","type":"news","url":"https://techcrunch.com/2020/06/26/telegram-to-pay-sec-fine-of-18-5-million-and-return-1-2-billion-to-investors-as-it-dissolves-ton/"},{"credibility":1,"name":"Justia: SEC v. Telegram Group Inc. et al, No. 1:2019cv09439 (S.D.N.Y. 2020)","type":"court_filing","url":"https://law.justia.com/cases/federal/district-courts/new-york/nysdce/1:2019cv09439/524448/227/"},{"credibility":1,"name":"CourtListener: Full Docket, SEC v. Telegram, 1:19-cv-09439","type":"court_filing","url":"https://www.courtlistener.com/docket/16325310/securities-and-exchange-commission-v-telegram-group-inc/"},{"credibility":2,"name":"Banking Dive: Telegram scraps crypto project amid court battle with SEC","type":"news","url":"https://www.bankingdive.com/news/telegram-scraps-crypto-project-amid-court-battle-with-sec/577864/"}]},{"content":"On August 24, 2024, Telegram CEO and TON co-creator Pavel Durov was arrested at Bourget airport outside Paris. French prosecutors formally placed him under investigation on approximately twelve criminal counts, including alleged complicity in money laundering, facilitating drug trafficking, organized fraud, distribution of child sexual abuse material, complicity in running an online platform permitting illicit transactions by an organized group, and refusal to provide encryption keys to law enforcement. French authorities contended that Telegram's limited content moderation, use of anonymous disposable phone numbers, and integration with cryptocurrencies including Toncoin had made the platform a facilitating environment for serious organized crime. Durov was released on 5 million euro bail with a travel ban preventing him from leaving France. TON's market price fell approximately 16–20% following the arrest, losing an estimated $2.4–2.7 billion in market capitalization within 48 hours. The network's total value locked (TVL) dropped 54% from its June 2024 peak and DEX activity on TON declined 66% in the aftermath. French authorities progressively eased restrictions through 2025; Durov was permitted limited international travel from March 2025, and France fully lifted his travel ban on November 13, 2025. The formal criminal investigation remained open as of that date with no trial date set. Durov has characterized the charges as 'legally and logically absurd.' The criminal charges against Durov are relevant to TON because they directly implicate Telegram's facilitation of illicit activity — a platform through which TON achieves almost all of its real-world adoption and user access.","heading":"Pavel Durov Arrest and Criminal Charges (2024–Present)","severity":"high","sources":[{"credibility":2,"name":"CryptoNews: Paris Judicial Court Reveals Charges Against Pavel Durov, Including Money Laundering","type":"news","url":"https://cryptonews.com/news/paris-judicial-court-reveals-charges-against-pavel-durov-includes-money-laundering-fraud/"},{"credibility":2,"name":"Bitcoin.com News: Telegram CEO Pavel Durov Arrested; TON Price Plummets","type":"news","url":"https://news.bitcoin.com/telegram-ceo-pavel-durov-arrested-in-france-ton-price-plummets/"},{"credibility":1,"name":"TechCrunch: Durov's Arrest Hasn't Dampened Enthusiasm for TON Blockchain","type":"news","url":"https://techcrunch.com/2024/09/13/telegram-ceo-durovs-arrest-hasnt-dampened-enthusiasm-for-its-ton-blockchain/"},{"credibility":2,"name":"CoinTelegraph: The Case Against Pavel Durov and Why It Matters for Crypto","type":"news","url":"https://cointelegraph.com/news/what-charges-pavel-durov-why-important-crypto"},{"credibility":2,"name":"The Block: Durov Reflects on French Criminal Case One Year After Arrest","type":"news","url":"https://www.theblock.co/post/368047/telegrams-pavel-durov-reflects-on-french-criminal-case-one-year-after-arrest-legally-and-logically-absurd"}]},{"content":"Security researchers documented a significant migration of wallet drainer malware from Ethereum to the TON blockchain in mid-2024. Drainer tools targeting TON users were sold in underground Telegram markets for as little as $300. One documented TON drainer operation exploited the network's native 'comment' feature in token transfer messages — which allows transfers to include custom text — to display deceptive messages such as 'Receive 5,000 USDT' with a 'Confirm' button. When users signed the transaction, a full drain of their wallet commenced. Scam Sniffer reported this incident resulted in the theft of approximately 22,000 TON tokens (approximately $152,000 at the time) in May 2024. The TON drainer ecosystem attracted operators because Telegram's platform provided a built-in distribution channel for phishing links and malicious bot forms, which SlowMist founder Yu Xian described as spreading easily because 'the Telegram ecosystem is too free.' In October 2024, one prominent TON-based drainer announced its closure via Scam Sniffer, stating it was shutting down 'due to TON not having whales and it being a small community,' and redirected users toward Bitcoin draining operations instead. The exit of this particular drainer was attributed to insufficient high-value targets rather than law enforcement action. According to Match Systems research, fake airdrops caused over $10 million in TON ecosystem losses from the start of 2024, and analysts estimated potential total 2024 fraud losses in TON could exceed $100 million. In the first six months of 2024 alone, over 1,200 fraud cases were reported in the TON ecosystem, a 45% increase over the same period in 2023.","heading":"Phishing Drainers and Wallet Theft Infrastructure (2024)","severity":"critical","sources":[{"credibility":2,"name":"CoinTelegraph: TON-Based Wallet Drainer Shuts Down, Eyes Bitcoin","type":"news","url":"https://cointelegraph.com/news/ton-wallet-drainer-shuts-down-eyes-bitcoin"},{"credibility":2,"name":"Match Systems: The Rise of Scams in the TON Ecosystem","type":"news","url":"https://matchsystems.com/rise_of_scams_ton_ecosystem/"},{"credibility":2,"name":"Yahoo Finance: TON-Based Wallet Drainer Shutters Operations, Shifts to Bitcoin","type":"news","url":"https://finance.yahoo.com/news/ton-based-wallet-drainer-shutters-133712893.html"},{"credibility":2,"name":"SlowMist Founder Warning on TON Ecosystem Phishing (via CoinSpeaker)","type":"news","url":"https://www.coinspeaker.com/slowmist-founder-phishing-toncoin-ecosystem/"},{"credibility":2,"name":"SlowMist: 2024 Blockchain Security and Anti-Money Laundering Annual Report","type":"news","url":"https://slowmist.medium.com/slowmist-2024-blockchain-security-and-anti-money-laundering-annual-report-d7fc94ccf624"}]},{"content":"Kaspersky documented a large-scale Toncoin-based pyramid scheme operating since at least November 2023 and targeting Telegram users globally. Victims were recruited via Telegram contacts sharing an alleged 'exclusive earning program.' Once recruited, victims were instructed to create a cryptocurrency wallet using an unofficial Telegram bot, then purchase a tiered 'booster' investment package ranging from 5 TON (labeled 'bike,' with 30% alleged commission) to 500 TON (labeled 'rocket,' with 70% alleged commission), costing approximately $33 to $3,000 USD at prevailing prices. All funds transferred to the scheme operators were irretrievably lost. The scheme promised earnings through two alleged mechanisms: a fixed 25 TON per recruited referral and tiered commissions based on recruits' booster purchases. Kaspersky characterized this as 'a classic pyramid scheme' in which 'nobody profits except the scammers.' The scheme was sustained by social trust within Telegram contact networks and the perceived legitimacy of Toncoin as an officially Telegram-endorsed asset. Separately, AML Crypto and CoinTelegraph documented a wave of scam activity in April 2024 coinciding with Telegram's formal announcement of its TON partnership, when fraudsters deployed fake airdrops, phishing websites, counterfeit NFT collections, and fraudulent Jetton tokens. Scammers also deployed counterfeit mini-apps mimicking legitimate TON games including Notcoin and Hamster Kombat to steal wallet credentials from users attracted by those platforms' genuine popularity.","heading":"Pyramid Schemes and Referral Bot Fraud (Kaspersky Investigation)","severity":"high","sources":[{"credibility":2,"name":"Kaspersky: Cryptocurrency Fraud with Toncoin on Telegram","type":"news","url":"https://www.kaspersky.com/blog/toncoin-cryptocurrency-scam/51042/"},{"credibility":2,"name":"Infosecurity Magazine: Fraudsters Exploit Telegram's Popularity For Toncoin Scam","type":"news","url":"https://www.infosecurity-magazine.com/news/telegram-exploited-toncoin-scam/"},{"credibility":2,"name":"CoinTelegraph: Scammers Eye Toncoin as Telegram-TON Partnership Grabs Headlines","type":"news","url":"https://cointelegraph.com/news/scammers-toncoin-pyramid-scheme"},{"credibility":2,"name":"AML Crypto: Scammers Targeted Toncoin Owners After Announcements","type":"news","url":"https://amlcrypto.io/blog/scammers_targeted_toncoin"}]},{"content":"Blockchain security firm SlowMist and independent researchers from Dilation Effect documented a pattern of fake USDT deposit fraud on the TON blockchain targeting major cryptocurrency exchanges including Binance, Bybit, MEXC, and Gate.io. Attackers deployed fraudulent smart contracts on TON designed to mimic the metadata of the official USDT smart contract. The exploit leverages TON's native 'bounceable' address and message architecture: when an attacker sends tokens to an exchange deposit address that lacks a deployed contract, with the 'bounce' flag set, the deposited amount is returned to the attacker's wallet minus transaction fees, while the target exchange records an apparent inbound deposit. This creates the appearance of a successful deposit while the funds never actually leave the attacker's control. SlowMist noted that bad actors were distributing fake USDT transactions 'in large quantities' across exchanges and that 'almost all blockchains face the problem of false deposits,' with TON being a notable current target. A separate but related earlier incident involved the exploitation of a GALA token contract upgrade on TON to drain all GALA held by Coinhub, a Mongolian exchange. The fake stablecoin vector is particularly dangerous for exchanges that had not yet implemented TON-specific deposit validation logic.","heading":"Fake Stablecoin Fraud Targeting Major Exchanges","severity":"high","sources":[{"credibility":2,"name":"crypto.news: Scammers Target Crypto Exchanges with Fake Stablecoins on TON","type":"news","url":"https://crypto.news/scammers-target-crypto-exchanges-with-fake-stablecoins-on-ton/"},{"credibility":2,"name":"SlowMist: 2024 Blockchain Security and Anti-Money Laundering Annual Report","type":"news","url":"https://slowmist.medium.com/slowmist-2024-blockchain-security-and-anti-money-laundering-annual-report-d7fc94ccf624"}]},{"content":"Security research firm Analyst1 documented that KillNet, a pro-Russia hacktivist organization conducting DDoS attacks against NATO-affiliated targets, adopted Toncoin as a primary fundraising and operational cryptocurrency, with Toncoin donations exceeding Bitcoin donations during the study period. Researchers attributed three Toncoin wallet addresses to KillNet, collectively receiving approximately 16,800 Toncoin (approximately $44,000 USD) as of mid-September 2023. KillNet Address #1 received 2,783 TON; KillNet Address #2 received 2,000 TON; a third address received additional amounts. In November 2022, KillNet purchased the @killnet Telegram username for 600 Toncoin via the Fragment marketplace, which provides anonymous username auctions settled in TON. KillNet also utilized Telegram's Wallet and Crypto Bot services for peer-to-peer fund movement, and at least 700 TON was transferred from one of the attributed addresses to a centralized exchange for cash-out. Analyst1 identified structural conditions favoring continued criminal adoption of TON: its migration from Tor to Telegram by cybercriminal communities, the high proportion of Russian-speaking users in Telegram's user base (approximately 30.73%), and the accessibility of TON-integrated financial services within Telegram. The Fragment marketplace's anonymous username auction mechanism was specifically identified as a mechanism enabling pseudonymous criminal branding and funding.","heading":"Use by Pro-Russia Hacktivist Groups (KillNet)","severity":"high","sources":[{"credibility":2,"name":"Analyst1: Toncoin and Its Use in Cybercrime — KillNet Case Study","type":"news","url":"https://analyst1.com/toncoin-and-its-use-in-cybercrime-killnet/"}]},{"content":"TON presents distinctive forensic challenges that differentiate it from more mature blockchains. TON uses a unique smart contract architecture based on an actor model and a non-standard address format that differs materially from EVM chains and Bitcoin, requiring specialized tooling that most compliance providers had not yet fully developed as of 2024. Match Systems, a blockchain analytics firm, explicitly noted that 'many blockchain analytics platforms lack TON support,' making stolen assets within the TON ecosystem 'nearly impossible to trace' using standard industry tools. While platforms such as Bubblemaps had added limited TON token visualization, and TRM Labs expanded multi-chain coverage, comprehensive address clustering and entity attribution for TON lagged significantly behind Ethereum and Tron coverage at major providers including Chainalysis and Elliptic. Telegram's historically limited cooperation with law enforcement — cited in the French criminal indictment of Durov and in prior assessments by European regulators — further reduces the effectiveness of reactive takedowns and KYC/AML enforcement. The TON Foundation had not, as of the time of this investigation, published an independently verified AML compliance program, transaction monitoring framework, or formal VASP licensing disclosure. These forensic and compliance gaps create structural conditions that favor illicit use and are a primary driver of the elevated risk assessment for this entity.","heading":"Structural Risk: Forensic Coverage Gaps and Traceability Limitations","severity":"high","sources":[{"credibility":2,"name":"Match Systems: The Rise of Scams in the TON Ecosystem","type":"news","url":"https://matchsystems.com/rise_of_scams_ton_ecosystem/"},{"credibility":2,"name":"CryptoNews: Telegram Privacy Battle With France Stalls, Leaving TON in Limbo","type":"news","url":"https://cryptonews.com/exclusives/one-year-on-telegrams-privacy-battle-with-france-stalls-leaving-ton-in-limbo/"},{"credibility":2,"name":"SlowMist: Analysis of 2024 Blockchain Security and Anti-Money Laundering Annual Report","type":"news","url":"https://slowmist.medium.com/analysis-of-the-2024-blockchain-security-and-anti-money-laundering-annual-report-phishing-and-scam-503f018c7c4c"}]},{"content":"This investigation was flagged with ZachXBT as a source tag, reflecting that ZachXBT's broader work on pig butchering infrastructure, Telegram-based scam networks, and money laundering ecosystems intersects significantly with TON's risk profile. As of the time of this investigation, no single standalone ZachXBT investigation specifically and exclusively focused on the TON blockchain was identified in open-source records. ZachXBT's documented work on Coinbase social engineering scams, pig butchering operations, and related fraud ecosystems frequently traced funds through Telegram-linked addresses and infrastructure, which overlaps with TON's operational environment. Regarding on-chain addresses: the TON drainer incident resulting in the theft of approximately 22,000 TON was referenced by multiple security outlets without the specific wallet addresses being published in accessible open-source reports. The three KillNet Toncoin addresses documented by Analyst1 represent the most specific publicly documented on-chain attribution for TON-linked illicit activity. No comprehensive curated list of flagged TON addresses with verified Tier 1 or Tier 2 source attribution was located at the time of this investigation. Investigators are directed to AML Crypto's TON monitoring services and tonscan.org for ongoing address lookups.","heading":"Note on ZachXBT Reporting and On-Chain Addresses","severity":"medium","sources":[{"credibility":2,"name":"Analyst1: Toncoin and Its Use in Cybercrime (KillNet addresses)","type":"on_chain","url":"https://analyst1.com/toncoin-and-its-use-in-cybercrime-killnet/"},{"credibility":2,"name":"ZachXBT Wikipedia","type":"other","url":"https://en.wikipedia.org/wiki/ZachXBT"}]}],"sources_used":[],"summary":"TON (The Open Network) is a layer-1 blockchain originally developed by Telegram, forcibly shut down by the SEC in 2020 after raising $1.7 billion in an unregistered securities offering and settling for an $18.5 million penalty. The network was relaunched by an independent open-source community and remains deeply integrated with Telegram's 900+ million-user platform, creating an exceptionally wide attack surface for scams, phishing drainers, pyramid schemes, fake stablecoin fraud, and criminal fundraising infrastructure. Telegram CEO Pavel Durov was arrested in France in August 2024 on twelve criminal counts including alleged complicity in money laundering, and the TON overlay network has been documented as active command-and-control infrastructure for Android banking malware, reflecting a systemic and escalating risk profile across multiple threat categories.","timeline":[{"date":"2018-01","event":"Telegram raises approximately $1.7 billion in two private presale rounds for the Telegram Open Network (TON) and its Gram token, from 171 accredited investors worldwide via SAFT agreements.","source":"SEC Filing / CoinDesk","source_url":"https://www.coindesk.com/policy/2020/06/25/telegram-agrees-to-pay-185m-penalty-in-sec-settlement-over-failed-ton-offering"},{"date":"2019-10","event":"SEC files emergency action against Telegram Group Inc. and TON Issuer Inc. in the Southern District of New York (Case No. 1:19-cv-09439), alleging $1.7 billion unregistered securities offering.","source":"CourtListener","source_url":"https://www.courtlistener.com/docket/16325310/securities-and-exchange-commission-v-telegram-group-inc/"},{"date":"2020-03","event":"U.S. District Judge P. Kevin Castel issues preliminary injunction blocking Gram token distribution, siding with the SEC.","source":"Blockchain and the Law","source_url":"https://www.blockchainandthelaw.com/2020/03/court-sides-with-sec-in-ruling-to-prevent-telegram-from-distributing-grams/"},{"date":"2020-05","event":"Telegram announces shutdown of TON initiative and drops appeal of the SEC ruling on May 25, 2020.","source":"Banking Dive","source_url":"https://www.bankingdive.com/news/telegram-scraps-crypto-project-amid-court-battle-with-sec/577864/"},{"date":"2020-06","event":"Settlement approved: Telegram returns $1.22 billion to investors, pays $18.5 million civil penalty, and is required to notify the SEC before future digital asset issuances for three years.","source":"SEC Press Release","source_url":"https://www.sec.gov/newsroom/press-releases/2020-146"},{"date":"2022-11","event":"KillNet purchases the @killnet Telegram username for 600 Toncoin via the Fragment marketplace, initiating documented use of TON for pro-Russia hacktivist fundraising and branding.","source":"Analyst1","source_url":"https://analyst1.com/toncoin-and-its-use-in-cybercrime-killnet/"},{"date":"2023-09","event":"Analyst1 identifies three Toncoin wallet addresses attributed to KillNet, collectively receiving approximately 16,800 TON (approximately $44,000 USD), exceeding KillNet's documented Bitcoin donations in the same period.","source":"Analyst1","source_url":"https://analyst1.com/toncoin-and-its-use-in-cybercrime-killnet/"},{"date":"2023-11","event":"Kaspersky identifies onset of large-scale Toncoin booster-bot pyramid scheme targeting Telegram users globally via referral recruitment, with losses per victim ranging from $2 to $2,700.","source":"Kaspersky Blog","source_url":"https://www.kaspersky.com/blog/toncoin-cryptocurrency-scam/51042/"},{"date":"2024-04","event":"Telegram formally announces partnership with TON. Scammers immediately deploy waves of fake airdrops, phishing sites, counterfeit Jetton tokens, and fraudulent NFT collections to exploit news-driven user interest.","source":"AML Crypto / CoinTelegraph","source_url":"https://cointelegraph.com/news/scammers-toncoin-pyramid-scheme"},{"date":"2024-05","event":"Scam Sniffer reports a TON wallet drainer exploiting the network's comment feature steals approximately 22,000 TON (~$152,000), marking the first major documented TON-specific drainer incident.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/ton-wallet-drainer-shuts-down-eyes-bitcoin"},{"date":"2024-06","event":"SlowMist founder Yu Xian issues public warning about escalating phishing attacks in the TON ecosystem. Kaspersky publishes formal analysis of the Toncoin booster-bot pyramid scheme. Monthly fraud cases on TON spike 30% month-over-month per Match Systems.","source":"CoinSpeaker / Kaspersky","source_url":"https://www.coinspeaker.com/slowmist-founder-phishing-toncoin-ecosystem/"},{"date":"2024-08","event":"Telegram CEO Pavel Durov arrested at Bourget Airport, Paris. Indicted on approximately twelve criminal counts including alleged complicity in money laundering, drug trafficking, and organized fraud. TON loses $2.4–2.7 billion in market cap within 48 hours; TVL drops 54% from June peak.","source":"Bitcoin.com News / CryptoNews","source_url":"https://news.bitcoin.com/telegram-ceo-pavel-durov-arrested-in-france-ton-price-plummets/"},{"date":"2024-10","event":"A major TON-based wallet drainer operator publicly announces exit from the market via Scam Sniffer, citing insufficient high-value targets on TON, and redirects its user community to Bitcoin draining.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/ton-wallet-drainer-shuts-down-eyes-bitcoin"},{"date":"2024-12","event":"SlowMist and Dilation Effect document fake USDT smart contracts on TON targeting Binance, Bybit, MEXC, and Gate.io using TON's bounceable address mechanism to simulate deposits while retaining funds.","source":"crypto.news","source_url":"https://crypto.news/scammers-target-crypto-exchanges-with-fake-stablecoins-on-ton/"},{"date":"2025-11","event":"French authorities lift travel ban on Pavel Durov. Criminal investigation remains open. TON token price rises approximately 20–29% on the news.","source":"The Block","source_url":"https://www.theblock.co/post/368047/telegrams-pavel-durov-reflects-on-french-criminal-case-one-year-after-arrest-legally-and-logically-absurd"}]},"v":1}