Before you send TON to an address or buy a jetton, check three things: whether the address is flagged in Tonkeeper’s scam database, whether the jetton contract has a revocable admin key, and whether the wallet has sent or received known scam airdrops. These checks take under a minute and catch most active threats.

How the TON ecosystem differs from EVM chains

TON uses an actor model where every wallet and smart contract has its own state. Jettons (TON’s equivalent of ERC-20 tokens) are deployed as a master contract with individual wallet contracts for each holder. This means:

  • The jetton admin key controls the master contract and can mint unlimited new tokens, change metadata, or freeze the entire supply.
  • Freezing works at the master contract level and can lock every holder simultaneously.
  • TON addresses are not checksummed the same way EVM addresses are, so impersonation via similar-looking addresses is easier.

Scammers exploit all three of these properties.

Checking a TON wallet address

Tonkeeper trust score

Tonkeeper maintains a public scam database fed by user reports and automated detection. When you look up an address in Web3defender’s wallet scanner, the result includes Tonkeeper’s classification: none, blacklist, or scam.

A “blacklist” result means the address is flagged as connected to scam activity. A “scam” result means Tonkeeper has high confidence it is actively malicious. Either result should stop you from sending funds.

Transaction history

Pull up the address on Tonscan or Tonviewer. Look at the last 30 days of activity:

  • Incoming transactions from many different wallets in small amounts: likely a collector address for a phishing campaign.
  • Outgoing transactions draining the balance immediately after each deposit: a pass-through wallet in a scam operation.
  • A pattern of the same comment on incoming TON payments: could be a payment processor (legitimate) or a mass phishing collector.

Scam airdrop senders

Many wallets receive jetton airdrops without consenting. Receiving an airdrop from a scam sender does not make the wallet a scammer. However, if an address is repeatedly sending to hundreds of wallets, it is likely an airdrop spammer or drainer deployer. Web3defender’s wallet scanner flags received funds from such addresses at medium severity - it is context, not a verdict.

Checking a jetton (TON token)

Admin key status

The jetton master contract has an admin address. This admin can:

  • Mint additional tokens (inflating supply).
  • Change the jetton metadata (name, symbol, image - a “metadata rug”).
  • Freeze the entire token.

On Tonscan, look at the jetton master contract and find the “Admin Address” field. If it points to a regular wallet (not a multisig or zero address), a single person controls the token supply. Legitimate projects either burn the admin key (set to the zero address) or use a governance contract with transparent signers.

Supply concentration

Jetton holder lists are available on Tonscan under the “Holders” tab. The same rules apply as on any chain: no single wallet above 15-20% unless it is a documented treasury, no cluster of new wallets holding large amounts bought at launch.

Liquidity pool lock

TON DEXes (DeDust, STON.fi) create LP positions for jetton pairs. If the project team controls their LP position, they can remove it. Check whether LP tokens are sent to a burn address or locked in a recognized contract with a public expiry.

Transfer fee and burn rate

TON jetton contracts can implement transfer fees paid to any address the deployer chooses. Read the contract code on Tonscan or look for the “transfer_fee” and “burn_rate” fields in contract metadata. A fee of 0% is neutral. Any fee going to an unlabeled wallet is a drain mechanism.

Common TON scam patterns

Fake USDT and stablecoins

TON has no uniqueness constraint on jetton names. Any wallet can deploy a jetton named “USDT” or “Tether USD.” Always verify by master contract address, not by name or symbol. The official USDT on TON has a specific, publicly documented contract address. Do not rely on what a token calls itself.

Comment-based payment fraud

TON payments use a text comment field for identifying transactions. Phishing sites instruct victims to send TON with a specific comment to a scammer’s address, claiming it is a “wallet activation fee” or “bridge deposit.” Legitimate TON services do not require payment to verify a wallet or bridge funds. Any instruction to “activate” an address by sending TON is a scam.

Drainer dApps

TON drainer applications present as DeFi protocols or NFT mints. They request a wallet signature to a transaction that actually moves the victim’s jettons to the attacker’s address. The TON Connect signing flow shows the transaction details - read them before confirming. Legitimate mints do not request access to your existing jetton balances.

How to run a quick safety check

  1. Copy the wallet address or jetton master contract address.
  2. Paste it into Web3defender’s wallet or token scanner.
  3. Check the Tonkeeper trust classification in the result.
  4. For jettons: check admin key status and top holder concentration.
  5. For wallets: check whether incoming transactions include flagged senders.
  6. If anything is flagged, open Tonscan and verify manually before sending.

What a clean result does not guarantee

A wallet or jetton that passes these checks has no detected scam signals at the time of the scan. It does not mean the project is legitimate, will deliver on its promises, or that the admin key will not be used against holders in the future.

On-chain safety checks are a filter, not a guarantee.

FAQ

Does receiving a scam airdrop jetton put my wallet at risk? Receiving tokens does not give the sender access to your wallet. However, interacting with the airdropped token (clicking a link in its metadata, trying to sell it on a phishing site) can expose you to drainers. The safest approach is to ignore unknown jetton airdrops.

What is the zero address on TON? The TON zero address is EQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM9c. Sending the jetton admin key there is equivalent to burning it - the admin function is permanently disabled.

Can Tonkeeper’s scam database be wrong? Yes. It is community-reported and heuristic-based. False positives exist for new addresses. Use it as a strong signal, not an infallible verdict. Multiple data sources together are more reliable than any single one.