A recent report from the American security company ANALYST1 showed that Toncoin (TON), one of the top ten cryptocurrencies by market capitalization, is used by the pro-Russian hacker group "KillNet" as one of its sources of operating funds, while using The Open Network's anonymous accounts, wallets and robots Serve. The integration of Telegram and TON is also seen as a new gathering place for illegal actors on the Dark Web.
"The deep integration of the Toncoin ecosystem with Telegram is concerning. Given the significant increase in illegal activity caused by bad actors moving from the Dark Web Tor to Telegram, the risk of Toncoin's growing popularity among cybercriminals also increases." ANALYST1 wrote.
( The Open Network (TON) in-depth analysis (Part 1): TVM’s innovation and vision )
Pro-Russian hacker group KillNet heavily uses Telegram and TON
Pro-Russian hacker group KillNet
ANALYST1 stated that KillNet is a pro-Russian hacker group that has been operating since the end of 2021 and engaged in DDoS attacks. It uses Toncoin as one of its funds. The group openly supports Russia by attacking entities that oppose Russian geopolitics. According to KillNet's Telegram tweet, it has attacked NATO countries multiple times.
KillNet is an old Telegram user
KillNet has been using Telegram for a long time, both as a communication channel and to solicit donations. They will request financial support in fiat currencies and various cryptocurrencies, including Toncoin.
Three of KillNet’s TON fundraising addresses
According to ANALYST1 research, there are three Toncoin addresses that are highly confident that they are related to KillNet: KillNet Address #1, KillNet Address #2, and KillNet Address #3. According to investigation, these three addresses received a total of nearly 16,800 Toncoin.
In addition to donations made by KillNet supporters to these three addresses, there will also be Russian patriotic comments, such as "Glory to Russia", etc. Many transactions are conducted through Telegram's Ton wallet and robots.
KillNet uses Telegram’s Fragment anonymous account service
The Fragment anonymous account service is Telegram's anonymous phone number auction market, and you can create a Telegram account without a SIM card. Users can enter any number they like (number length is 4~8 digits), and after connecting Ton's blockchain wallet Tonkeeper, they can use TON tokens to bid.
That is, people can use TON to purchase Telegram accounts whose true identity will not be found. KillNet used a SIM-free registration service to purchase the @killnet username linked to one of KillNet's channels. It was sold on November 18, 2022 for 600 Toncoin.
( Telegram privacy upgrade! Fragment launches "phone number" market, buy anonymous account for $17 )
Only part of KillNet
ANALYST1 said that through the study of a single case, the cycle of money flow from these three addresses to the exchange can be found. But uncovering the full scope of Toncoin used by KillNet will require further investigation.
Illegal risks of Telegram and Ton
ANALYST1 believes that cybercriminals are often attracted to specific cryptocurrencies, often due to the features that make it easier to conduct illegal activities. Several factors could lead to wider adoption of Toncoin (TON) by malicious actors in the Telegram ecosystem. TON's goal is to attract nearly 30% of Telegram's active users, or nearly 300 million people in the next three to five years, which may also lead to a sharp increase in illegal activities.
Illegal activity moves from Dark Web Tor to Telegram
ANALYST1 said that in the past two years, more and more malicious actors have moved from the Dark Web Tor to Telegram, and the number of illegal activities on Telegram has increased dramatically. ANALYST1 observed various illegal services on Telegram, including paid DDoS attacks, money laundering services, skimming, ransomware, "Initial Access Broker" (IAB), KillNet and other hacker organizations.
Telegram’s large number of Russian users poses risks
ANALYST1 believes that since 30.73% of Telegram’s traffic comes from Russia and there are a large number of Russian-speaking people involved in illegal activities, Toncoin may be adopted more widely.
TON x Telegram x Russian Finance
ANALYST1 believes that Toncoin (TON)’s deep integration with Telegram’s various services, such as wallets, cryptobots, donations, and fragments, poses a risk of being exploited by malicious actors. Buying and sending cryptocurrencies without leaving the platform provides illicit actors with great convenience, anonymity and availability.
There is also the use of Russian financial institutions, which poses risks. ANALYST1 believes this availability simplifies cash-out activities and creates potential opportunities for cybercriminals. This activity can involve a variety of circumstances, from cybercriminals directly exploiting the financial institutions themselves, to the involvement of money launderers.
Ton Foundation’s Russian Connection
In fact, Max Pertsovskiy, the operating director of Ton Foundation, was also the operating director of Waves Labs. Waves Labs has always had close ties with Russian government agencies and is believed to have helped handle Russian financial flows. It received a lot of attention during the war between Russia and Ukraine.
ANALYST1 sends a warning to the world
ANALYST1 stated that it is important to implement strong measures and formulate regulations to effectively prevent illegal activities within the Toncoin ecosystem. Although Toncoin is not the only cryptocurrency used in cybercrime.
But its deep integration with Telegram has raised concerns. Because there is a lot of illegal activity on Telegram, it facilitates cybercriminals and should be continuously monitored.
The top ten cryptocurrencies TON have limited liquidity: Binance and Coinbase are not listed
Although TON is currently one of the top ten cryptocurrencies by market capitalization, TON's liquidity-to-market capitalization ratio is quite low compared to other cryptocurrencies. Taking Bitcoin as an example, the "transaction volume/market capitalization" ratio of Bitcoin is 0.026, ETH is 0.035, and TON is only 0.004. The gap is very large, which shows that the liquidity conditions are not very good.
In addition, TON is also the only cryptocurrency among the top ten market capitalization cryptocurrencies that is not listed on Binance and Coinbase. 43.6% of the trading volume is concentrated in HTX (Huobi) and Poloniex. It is also worth exploring the reasons.
