The Open Network (TON), a blockchain platform based on Telegram, has experienced record-breaking growth in 2024. The number of onchain-activated wallets surged from approximately one million in January to over nine million in June.

However, TON’s massive inflow of new users has not been overlooked by scammers. In June 2024, blockchain security firm SlowMist issued a warning on increasing phishing attacks on the TON ecosystem.

As the TON Foundation ambitiously expects to onboard 500 million users by 2028, it raises the question of how to properly protect users from attacks of all possible vectors without hindering rapid adoption.

Cointelegraph contacted several executives and firms — including the TON Foundation — to better understand the nature of risks in the TON ecosystem and identify steps to keep users’ assets safe.

Telegram isn’t responsible for the safety of mini-apps, says Hacken exec

While identifying the risks in the TON ecosystem, one should realize that Telegram is not responsible for the safety of TON mini-apps.

The number of mini-apps on Telegram — such as Notcoin or Hamster Kombat — has been surging significantly over the past few months. However, not all of those apps adhere to the best practices of security to ensure the safety of funds by their users, Stepan Chekhovskoi, lead smart contract auditor at the cybersecurity firm Hacken, told Cointelegraph.

“It’s worth mentioning that this is not Telegram’s fault,” Chekhovskoi emphasized, adding that users’ safety on mini-apps lies on founders and project teams. He added:

“However, Telegram has to take care of the security of the platform itself and to ensure its functionality enables users to seamlessly secure its accounts; it has little to nothing to do with the security of a mini-app developed by a third party.”

A spokesperson from the TON Foundation confirmed that users and projects are solely responsible for safety, stating:

“As TON blockchain is open-source and permissionless, individual users and projects must be careful to ensure their own safety and security when undertaking network activity.”

TON Foundation “impressed” with security measures by some mini-apps

The TON Foundation strongly encourages security measures adopted by mini-apps on TON.

“We have been impressed with the actions of many projects as they look to protect their users,” a representative at the TON Foundation told Cointelegraph.

For example, Tonkeeper, one of the most popular TON wallets, has enabled users to mark whether a non-fungible token (NFT) they have been sent is legitimate.

The spokesperson also highlighted the importance of an active and engaged community as one of the best safeguards against bad actors. The representative added:

“Users should always be careful when transacting onchain. Please remember that any onchain transaction is irreversible. We strongly advise our users not to click on suspicious links, and double-check every detail before signing any onchain transaction.”

Self-custodial and custodial mini-apps on Telegram

According to Hacken’s Chekhovskoi, Telegram mini-apps are “no different” from apps built on other platforms from a security perspective. As such, one should apply the same web and crypto security measures to those apps.

According to Chekhovskoi, Telegram’s mini-apps have two ways of managing user private keys, which can be compared to custodial and non-custodial wallets in crypto.

“The majority of Telegram mini apps are custodial, so like any other provider of a custodial wallet, they must properly identify their users using additional passwords, 2FA mechanisms and others,” the expert said.

For self-custodial apps, users must ensure strong encryption for private key storage. “If the application doesn’t require an eight-symbol-character password, including numbers and special symbols, or at least a fingerprint, it means the private key is not securely encrypted,” Chekhovskoi noted.

Related: Bybit lists Hamster Kombat’s token for pre-market trading

Users should also vary the risks associated with automated log-in on all devices. If the automated log is enabled, anyone who gets access to the user’s device by default has access to their mini apps.

Non-technical threats on TON ecosystem

The TON ecosystem’s decentralized nature and ease of use naturally lure scammers, and there’s “no silver bullet to protect users,” according to Hacken.

To avoid non-technical scams on TON, individuals should exercise caution when interacting with non-official apps and those launched by lesser-known developers.

According to Steve Milton, co-founder and CEO of the crypto wallet Fintopio, one way to avoid potential phishing attacks is to check whether mini-apps have a verification mark.

Telegram offers verification for public figures and organizations so that users can easily identify official sources. The Telegram team generally verifies bots, as well as official channels or public groups.

“Projects that have undergone this rigorous process, such as Fintopio, have demonstrated a commitment to transparency and reliability,” Milton said.

Hacken’s Chekhovskoi also cautioned against get-rich-quick schemes on Telegram, stressing that free cheese is only found in a mousetrap. He stated:

“Always remain skeptical of free money offerings. If you embrace a suspicious opportunity, it is better not to risk your main crypto wallet and create a new account for this purpose.”

For more tips on staying safe on TON and Telegram, users can also follow relevant guidance from the TON Foundation.

Magazine: As Ethereum phishing gets harder, drainers move to TON and Bitcoin