What to know first
The core checks are the exact app origin, the token master or NFT item and collection, and the action requested in the wallet. Names, logos, Telegram placement, and a successful connection do not establish legitimacy. Gramium never needs a recovery phrase, and its market listings and warnings cannot certify that a token or transaction is safe.
Key takeaways
- Token metadata can be copied; contract identity needs a published reference.
- A connection, a message signature, and an on-chain transaction are different wallet requests.
- Disconnecting an app does not undo a transfer or replace compromised wallet keys.
Practical checks
- Check the exact website origin and bot or channel handle against an independently opened official reference.
- Compare the token master or NFT item and collection with the intended project's published identity.
- Read the requested action, recipient, asset, amount, and any additional messages in the wallet.
- Reject requests for recovery words, private keys, or an unexplained payment to unlock or recover funds.
- If something happened already, retain transaction links and use official wallet or provider support rather than unsolicited recovery contacts.
Fake tokens and collectible copies
TON Docs explicitly warns that tokens can copy names, symbols, and images. A holder's token wallet address is also different from the master contract that identifies the token type. Compare the right contract when checking an asset.
NFT images and labels can be copied too. For a collectible, inspect the item address, collection, and current owner. An explorer proves recorded state; it does not independently prove that the advertised project controls a particular collection.
Telegram placement and phishing
A Telegram Mini App is a web interface launched inside Telegram. That delivery surface does not authenticate a token or make every link in a bot safe. A copied bot name, forwarded announcement, or urgent direct message can lead to an unrelated domain.
Open the project's own references independently and compare the origin before connecting a wallet. A legitimate domain can also change or be compromised, so the actual transaction request still matters.
Connection, signature, and transaction
TON Connect supports reading a connected address, requesting signatures, and sending transaction requests without exposing the private key to the app. These are separate operations. A signature may prove account control or authorize a specific application action, depending on its content.
Review the full prompt, including multiple messages when present. If the wallet cannot explain an unfamiliar payload, a familiar button label in the website does not fill that gap. Gramium portfolio browsing does not require a transfer; supported swaps require a separate wallet request.
Market risk can exist without an obvious fake
Correct token identity is only one check. Pool inventory, execution conditions, contract powers, and data gaps are different questions. An available quote proves that a provider returned terms at that moment; it does not certify future sell liquidity.
Holder concentration and contract behavior require their own evidence. If the source is unavailable, a clean-looking interface or missing warning should not be treated as an affirmative safety result.
After an unexpected request or transfer
Reject pending requests that you do not understand and inspect what was actually submitted using the wallet's transaction links. Disconnecting a session stops that connection; it cannot reverse a confirmed transfer or make a leaked key private again.
If recovery material may have been disclosed, use your wallet's current compromise and recovery instructions. Different wallets have different key-management features. No dashboard or support chat can promise recovery of an irreversible transfer.
Sources and review
Reviewed . Sources support the definitions below; market observations and product availability keep their own dates.
- TON Docs: fake token detection
Copied token metadata and the need to verify master and holder-wallet relationships.
- TON Docs: inspecting assets and traces
NFT identity and ownership, recipient execution, and transaction traces.
- Telegram: Mini Apps documentation
Mini Apps as web interfaces launched inside Telegram.
- TON Docs: TON Connect
Connected-address access, signature requests, and wallet-controlled transactions.
- TON Docs: wallet recovery and key management
Recovery phrases control access; backup and key rotation depend on the wallet product.
FAQ
Can Gramium guarantee that a token is safe?
No. Contract labels, routes, listings, and warnings provide context; they do not certify project legitimacy or every possible contract action.
Does disconnecting a wallet undo an approved transfer?
No. Ending a TON Connect session does not reverse a confirmed transaction or replace keys that have been exposed.
Should I enter recovery words to connect to Gramium?
No. Gramium uses TON Connect and does not need recovery words or private keys. A request to paste them into a dashboard or chat is not part of this connection flow.