A Mini App running inside Telegram is still a third-party service, and its wallet request needs the same scrutiny as a request from a website. Verify the provider and actual app domain, then read the complete action in the wallet: connection, proof, data signature and asset transfer are different requests. Do not rely on the word Connect to establish that no transaction is included.
Telegram is the container, not the counterparty
Telegram’s Mini App terms describe services supplied by third parties and distinguish Telegram’s platform from the providers handling the service and its transactions. A familiar navigation bar does not identify the operator of the embedded page. Nor does opening without an external browser establish that a reward, marketplace or wallet-verification claim is genuine.
Start with the source that says the app exists. If a known project supposedly operates it, reach that project independently and confirm the exact bot or Mini App entry point. A link inside the suspicious app claiming to lead to a real project is evidence of a claim, not confirmation that the project operates the app. Keep that distinction before you reach a wallet prompt.
Kaspersky’s Mini App phishing investigation documents credential collection presented inside Telegram’s interface. The example concerns Telegram account access, not proof that every Mini App steals wallet keys. It illustrates why the visible container cannot authenticate the embedded operator. A request for a Telegram login code belongs to a different security context from an ordinary wallet connection.
Translate the screen into the action it requests
| Request shown | What needs checking | What must not be assumed |
|---|---|---|
| Share a wallet address | Which app and network receive the selected account data | The operator is trustworthy because the address is public |
| Prove ownership of an account | The requesting domain and the proof’s intended context | Every signature is merely a harmless login |
| Sign application data | The visible content and consequences of the data being signed | No immediate gas charge means no relevant authorization |
| Send an asset or perform a transaction | Selected account, network, asset, recipients and amounts | The app’s reward label describes the actual outgoing operation |
| Connect and act in one flow | Every action included in the combined wallet confirmation | A second screen must appear before anything is signed |
| Enter words or a Telegram code on the page | Why the page is asking for an unrelated secret | This is a required wallet-connection step |
These categories are a reading aid, not a universal list of everything a wallet can authorize. Mini Apps may use different networks and wallet protocols. A legitimate TON Connect flow should not be treated as an explanation of an Ethereum permission request, and a Telegram account login is not the same as signing with a blockchain account. Identify the actual wallet and network before applying a familiar security checklist.
TON Connect: inspect the domain behind the icon
The official TON Connect manifest specification describes app metadata fetched by the wallet, including name, icon and app URL. An icon and name supplied by an application can help display its request; they are not a third-party audit of its operator. Compare the app domain with the independently verified project entry point instead of recognizing only the artwork.
The connection specification distinguishes sharing account information from requesting an account-ownership proof. It also carries network context. Read the selected account and chain rather than inferring the network from a logo or a balance screenshot. A valid proof for a domain does not establish that the service behind that domain will honour a promised reward.
You do not need to extract protocol payloads or paste them into a random decoder to make this check. Use the wallet’s supported request view and official help if the display is unclear. If the domain is unexpected, the account is wrong or the action cannot be explained, decline rather than approving it simply to discover what the next page says.
A connection can arrive with an embedded action
Current TON Connect deep-link documentation allows supported wallets to process an embedded transaction or signing request as part of a connection flow. This does not make every connection a payment. It means the number of screens is a poor safety rule: inspect what the wallet actually asks you to authorize, including a combined action.
For a fictional example, Mira opens an app advertised as a membership check. The page says Connect, but the wallet review contains an outgoing asset action. Mira should compare that action with her actual intention, not assume it will be followed by a separate approval later. If she only intended to identify an account, an unexplained outgoing action is a reason to stop.
Do not classify a small visible native amount as the full financial effect without understanding the request. An operation may involve a token, collectible or contract interaction as well as network costs. Read every recipient and asset shown by the supported wallet interface. If part of the action remains opaque, lack of an obvious large payment is not evidence that approval is appropriate.
Use a check tied to your original intention
- Write down the action you intended before opening the app: identify an account, inspect a service or make a specific transfer.
- Confirm the provider’s actual Mini App or bot through an independent official source, then compare the domain shown by the wallet.
- Check the selected account and real network. A familiar app name does not establish either.
- Read the full request, including embedded actions, recipients, assets, amounts and the content of any signature.
- Decline requests for recovery words, Telegram login codes, unrelated signatures or unexplained outgoing operations.
- If anything was already approved, preserve its actual type and reference before deciding which containment process applies.
An ordinary connection can disclose account information and allow later interaction requests; it should not be described as equivalent to handing over a seed phrase. But that distinction is useful only if you actually saw a connection-only request. Do not downgrade a transaction to a connection because the Mini App’s own button used reassuring wording. The wallet request and the resulting activity are the evidence to inspect.
If you already interacted, respond to what actually happened
If you only connected, remove the unwanted connection through the wallet’s supported controls and stop further requests. If you signed data or sent a transaction, preserve the relevant record and ask official wallet support what that particular action authorized. Disconnecting the app does not reverse an already completed transfer, and it should not be presented as a universal cancellation of all signed material.
If you entered recovery words, treat that as a separate secret-exposure incident. If you supplied Telegram login information, inspect Telegram sessions and account protection through its official process. These are different exposures even when they began on the same page. Do not add a verification payment to make a claimed refund available, or grant another signature to someone who appears in private messages offering help.
The recovery-phrase storage guide explains why a web form is not a place for a wallet backup. Before an intended exchange, compare the service’s own how-it-works page and simple-swap workflow with the request you see. KOT.CASH’s exchange pages do not endorse a third-party Mini App that uses its name. Verify the actual service and order context rather than treating Telegram’s interface as that verification.
FAQ
Does a TON Connect wallet request prove the Mini App is legitimate?
The request can show app and account context, but it does not certify the operator’s promises. Confirm the actual entry point and inspect the complete wallet action.
Can a TON wallet connection include an action in the same flow?
Supported TON Connect embedded requests can combine connection and an action. Read the full confirmation rather than assuming a separate payment or signing screen must appear later.
Does an unable-to-connect wallet error mean I should enter my recovery words?
No, a connection problem is not a reason to disclose a recovery secret to the Mini App. Use official wallet troubleshooting and decline requests for unrelated credentials.