Slow Fog: Investigation of Chat Screenshots Related to Actor Wang Xing's Scam Incident
Author: Lisa, Slow Fog Technology
Background
Recently, the incident of actor Wang Xing being deceived to Myanmar has attracted widespread attention online, and the public is curious about the details behind the case. The Slow Fog security team noticed that a screenshot of a chat record has been widely circulated on social media, with the group name being "Wealthy House Special Group Need Side Deposit 14,000u." The screenshot mentions that Wang Xing has "got on the car," and the so-called guarantee fee is 14,000 USDT, accompanied by a cryptocurrency address for collecting the guarantee fee: TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn. Is the truth of the matter really as depicted in the image?
Specific Analysis
To clarify the truth, the Slow Fog security team started analyzing the TRON address from the screenshot:
First, we conducted a comprehensive search for information related to the address TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn:
We found several major Telegram channels, with the largest group having nearly eight thousand members:
- @fufugq:
- @FUFU:
- @TOTO:
- @YAYA:
Following the leads to their announcement channels, we found discussions about the Wang Xing incident:
Next, we used the on-chain anti-money laundering tracking platform MistTrack to analyze the TRON address. The results showed that the initial transaction for this address occurred on September 9, 2024, and the most recent transaction occurred on January 12, 2025. It has received a total of 2.22 million USDT, with a current balance of 91,000 USDT. This address has interacted with multiple malicious and medium-risk addresses.
By filtering the outgoing transactions from this address, we found that the recipients were almost all user addresses from a certain platform, suggesting that these user addresses might belong to employees of "Wealthy House."
According to the timeline released by the Thai Immigration Bureau on January 7, Wang Xing entered Thailand at 3:16 AM local time (Thailand time UTC+7) on January 3, left Suvarnabhumi Airport by car at 3:40 AM, and subsequently went missing around 11 AM. We analyzed the receiving transactions for the address TAiv3gxSGkf7xWdEwWqoWgAB6FU4XV5HPn starting from 4:16 AM on January 3 (China time UTC+8):
2025-01-03 16:47:42 Received 5,500 USDT
2025-01-03 22:28:33 Received 5,500 USDT
2025-01-04 15:47:15 Received 4,145 USDT
2025-01-04 16:25:57 Received 5,500 USDT
2025-01-04 18:30:57 Received 5,528 USDT
2025-01-04 21:19:00 Received 8,289 USDT
2025-01-04 21:41:42 Received 6,896 USDT
2025-01-06 11:31:09 Received 6,908 USDT
…
No transaction amount of 14,000 USDT was found.
Looking back at the initial screenshot, we found that the chat time displayed was 02:46, while the image time showed 19:46, indicating a time inconsistency that further confirms the screenshot is false information. If it were not a forged screenshot, the image time should display between 02:41 and 02:46 according to the order of the three screenshots.
Final Thoughts
The incident of Wang Xing being deceived has already touched many hearts, and the spread of fake screenshots has further exacerbated public anxiety. The timeline in the screenshot and the transaction analysis of the TRON address indicate that the screenshot is fabricated and has no direct connection to the incident. This rumor also serves as a warning to us: maintaining clarity and continuously verifying information is the best attitude when facing various information.
