Background

Recently, the incident of actor Wang Xing being deceived to Myanmar has attracted widespread attention on the Internet, and the public is curious about the details behind the case. The SlowMist security team noticed that a screenshot of a chat record was widely circulated on social media. The group name in the screenshot was "Fufu Special Group Demanders Deposit 14000u". The screenshot mentioned that Wang Xing had boarded the car, and the so-called guarantee fee was 14,000 USDT, and was attached with a cryptocurrency address for collecting the guarantee fee: TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn. Is the truth of the matter really as shown in the picture?

Specific Analysis

To clarify the truth, the SlowMist Security Team started with the TRON address in the screenshot and conducted an analysis:

First, we searched the entire network for information related to the address TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn:

Several major Telegram Channels are obtained as follows, with the largest group of nearly 8,000 members:

1. @fufugq：

2. @FUFU：

3. @TOTO：

4. @YAYA：

Next, we used the on-chain anti-money laundering tracking platform MistTrack to analyze the TRON address. The results showed that the initial transaction of the address occurred on September 9, 2024, and the most recent transaction occurred on January 12, 2025. A total of 2.22 million USDT was received, and the current balance is 91,000 USDT. The address has interacted with multiple malicious addresses and medium-risk addresses.

Screening the entity addresses in the transfer transactions of this address, it is found that the transfer objects of this address are almost all user addresses of a certain platform. It is speculated that these user addresses may be employee addresses of "Fufu".

According to the timeline released by the Immigration Bureau of Tak Province, Thailand on January 7, Wang Xing entered Thailand at 3:16 am on January 3, local time (UTC+7, Thailand time), left Suvarnabhumi Airport by car at 3:40, and then lost contact at around 11 am. We analyze the receiving transactions of the address TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn mentioned in the screenshot starting at 4:16 am on January 3 (UTC+8, China time): 2025-01-03 16:47:42 Income 5,500 USDT 2025-01-03 22:28:33 Income 5,500 USDT 2025-01-04 15:47:15 Income 4,145 USDT 2025-01-04 16:25:57 Income 5,500 USDT 2025-01-04 18:30:57 Income 5,528 USDT 2025-01-04 21:19:00 Income 8,289 USDT 2025-01-04 21:41:42 Income 6,896 USDT 2025-01-06 11:31:09 Income 6,908 USDT ... No income transaction of 14,000 USDT was found.

Looking back at the original screenshot, it is found that the chat time is shown as 02:46, while the picture time is shown as 19:46. The time is inconsistent, which further proves that the screenshot is false information. If it is not a fake screenshot, according to the order of the three screenshots, the picture time should be displayed between 02:41 and 02:46.  

Written at the end

The incident of Wang Xing being deceived has already touched people's hearts, and the spread of fake screenshots has further aggravated the public's anxiety. The timeline in the screenshot and the transaction analysis conclusion of the TRON address show that the screenshot is fake and has no direct connection with the incident. This rumor also warns us that staying sober and constantly seeking verification is the best attitude to face various information.