Slow Mist: Investigation into chat screenshots related to actor Wang Xing’s cheating incident

Author: Lisa, SlowMist Technology

background

Recently, the incident of actor Wang Xing being deceived into Myanmar has attracted widespread attention on the Internet, and the public is full of curiosity about the details behind the case. The SlowMist security team noticed that a screenshot of the chat record was widely circulated on social media. The group name in the screenshot was "Fufu Special Group Demand Party Deposits 14000u". The screenshot mentioned that Wang Xing has got on the bus, and the so-called The guarantee fee is 14,000 USDT and comes with a cryptocurrency address for collecting the guarantee fee: TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn. Is the truth of the matter really as shown in the picture?

Detailed analysis

In order to clarify the truth, the SlowMist security team started with the TRON address in the screenshot and conducted analysis:

First, we search the entire network for information related to the address TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn:

Several major Telegram Channels are obtained as follows, and the group with the largest number of members reaches nearly 8,000 people:

1. @fufugq：

2. @FUFU:

3. @TOTO:

4. @YAYA：

Then I followed the lead to their news release channel group and found that they had discussed the King Star incident:

Next, we used the on-chain anti-money laundering tracking platform MistTrack to analyze the TRON address. The results showed that the initial transaction of this address occurred on September 9, 2024, and the most recent transaction occurred on January 12, 2025. A total of 2.22 million USDT, and the current balance is 91,000 USDT. This address has interacted with multiple malicious addresses and medium-risk addresses.

After screening the physical addresses in the address transfer transaction, it was found that almost all the transfer objects of this address were the addresses of users of a certain platform. It is speculated that these user addresses may be the addresses of employees of "Fufu".

According to the timeline announced by Thailand's Tak Province Immigration Bureau on January 7, Wang Xing entered Thailand at 3:16 a.m. on January 3, local time (Thailand time UTC+7), and left Suvarnabhumi by car at 3:40 Airport, and then lost contact around 11 o'clock. We analyze the receiving transactions of the address TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn mentioned in the screenshot starting at 4:16 am on January 3 (UTC+8, China time):

2025-01-03 16:47:42 Income 5,500 USDT

2025-01-03 22:28:33 Income 5,500 USDT

2025-01-04 15:47:15 Income 4,145 USDT

2025-01-04 16:25:57 Earn 5,500 USDT

2025-01-04 18:30:57 Income 5,528 USDT

2025-01-04 21:19:00 Income 8,289 USDT

2025-01-04 21:41:42 Income 6,896 USDT

2025-01-06 11:31:09 Income 6,908 USDT

...

No revenue transaction was found for the amount of 14,000 USDT.

Looking back at the original screenshot, we found that the chat time was displayed as 02:46, while the picture time was displayed as 19:46. The times were inconsistent, which further confirmed that the screenshot was false information. If it is not a fake screenshot, according to the order of the three screenshots, the picture time should be displayed between 02:41 and 02:46.

write at the end

The incident of Wang Xing being deceived has already touched people's hearts, and the spread of fake screenshots has further aggravated public uneasiness. The timeline in the screenshot and the transaction analysis conclusion of the TRON address indicate that the screenshot is fake and not directly related to the incident. This rumor also warns us that staying awake and constantly seeking verification is the best attitude when facing all kinds of information.