Background

Recently, the incident of actor Wang Xing being deceived into Myanmar has attracted widespread attention on the Internet. Curious about the details behind the case. The SlowMist security team noticed that a screenshot of the chat record was widely circulated on social media. The group name in the screenshot was "Fufu Special Group Demand Party Deposits 14000u". The screenshot mentioned that Wang Xing has got on the bus, and the so-called The guarantee fee is 14,000 USDT and comes with a cryptocurrency address for collecting the guarantee fee: TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn. Is the truth of the matter really as shown in the picture?

To clarify the truth, the SlowMist security team started with the TRON address in the screenshot , expand the analysis:

First, we search the entire network for information related to the address TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn:

Get several major Telegram Channels as follows, the group with the largest number of members reaches nearly 8,000 people:

1. @fufugq：

2. @FUFU：

3. @TOTO：

4 . @YAYA:

Following the clues to their news release channel group, I found that they had Discussed the King Star incident:

Next, we useUsing the on-chain anti-money laundering tracking platform MistTrack to analyze the TRON address, the results show that the initial transaction of this address occurred on September 9, 2024, and the most recent transaction occurred on January 12, 2025, with a total of 2.22 million USDT received. , the current balance is 91,000 USDT. This address has interacted with multiple malicious addresses and medium-risk addresses.

Screen the entity address in the transfer transaction of this address and find the transfer of this address The objects are almost all user addresses of a certain platform, and it is speculated that these user addresses may be the addresses of employees of "Fufu".

According to the timeline announced by the Immigration Bureau of Tak Province, Thailand on January 7, Wang Xing He entered Thailand at 3:16 a.m. local time (Thailand time UTC+7) on January 3, left Suvarnabhumi Airport by car at 3:40 a.m., and then lost contact around 11 a.m. We analyze the receiving transactions of the address TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn mentioned in the screenshot starting at 4:16 am on January 3 (time UTC+8):

2025-01-03 16:47:42 Revenue 5,500 USDT

2025-01-03 22:28:33 Income 5,500 USDT

2025 -01-04 15:47:15 Income 4,145 USDT

2025-01-04 16:25:57 Earn 5,500 USDT

2025-01-04 18:30:57 Earn 5,528 USDT

2025-01-04 21:19:00 Income 8,289 USDT

2025-01-04 21:41:42 Income 6,896 USDT

2025-01-06 11:31:09 Income 6,908 USDT

...

No income transaction found for the amount of 14,000 USDT.

Looking back at the original screenshot, we found that the chat time was displayed as 02:46, while the picture time was displayed as 19:46. The times were inconsistent, which further confirmed that the screenshot was False information. If it is not a fake screenshot, according to the order of the three screenshots, the picture time should be displayed as between 02:41 and 02:46.

Write at the end

The incident of Wang Xing being deceived has already touched people's hearts, and the spread of fake screenshots has further aggravated public uneasiness. The timeline in the screenshot and the transaction analysis of the TRON address indicate that the screenshot is fake and not directly related to the incident. This rumor also warns us that staying awake and constantly seeking verification is the best attitude when facing all kinds of information.