How to Connect Your TON Wallet to a Telegram Mini App Safely

31 October 2026

Connecting a TON wallet to a Telegram Mini App is straightforward, but the safety of your funds depends entirely on how you approve the connection and what permissions you grant. You connect through TON Connect, a protocol that lets a Mini App request access to your wallet without you ever revealing your seed phrase or private keys. The safe method is to use a wallet you control, verify the app's domain, review the exact permissions requested, and reject any prompt that asks for more than a simple transaction confirmation.

Understand what "connecting" actually means

When a Mini App asks to connect your wallet, it is not giving the app access to your funds directly. Instead, TON Connect creates a session between the app and your wallet. This session is tied to a specific public key and a set of permissions. The app can see your wallet's address and, depending on the permissions, request transactions or messages from you.

Crucially, the app never receives your private key. It also cannot move funds on its own. Every transaction must be signed by your wallet, and you must confirm each one. The risk is not that a malicious app will "steal" your wallet; the risk is that you will approve a transaction that sends funds to an address you did not intend.

Step 1: choose your wallet version

You need a wallet that supports TON Connect. The two most common are Tonkeeper and the Telegram Wallet bot, but the same principles apply to any TON Connect-compatible wallet.

• Tonkeeper: A standalone mobile or browser wallet. You control the private keys locally.
• Wallet bot on Telegram: Custodial, meaning Telegram's infrastructure holds the keys on your behalf. Easier for beginners but less control.

For safety, Tonkeeper is generally recommended when interacting with third-party Mini Apps, because you review each transaction in a separate interface. With the Wallet bot, the approval prompts appear inside Telegram, which is convenient but can feel less transparent.

Step 2: Open the Mini App and Initiate the Connection

Open the Mini App inside Telegram. Look for a button that says "Connect Wallet" or "Sign In." Tap it. A modal or a new screen should appear, asking you to select a wallet.

Step 3: Verify the Domain and App Name

Before you select your wallet, stop and look at the connection request. Most wallets will display:

• The name of the app.
• The app's domain (e.g., app.dupetheduck.com).
• The wallet address you are connecting.

The domain is the most important field. Scammers can create a fake Mini App with a similar name, but they cannot easily spoof a legitimate domain in the TON Connect request. If the domain looks wrong, or if you do not recognize the exact URL, do not connect. Close the prompt and leave the app.

Step 4: Review the Requested Permissions

TON Connect uses a standard set of permissions. A legitimate app will typically request:

• Read access to your wallet address and public key. This allows the app to show your balance and identify you.
• A request for a signature when you want to approve a transaction.

Some apps may ask for "tonchain:sendTransaction" at connection time. This is normal for a DEX or a game that needs to submit transactions. However, you should never see a request for your seed phrase, private key, or for "full control" of your wallet. If you do, reject it immediately.

Step 5: Approve the Connection and Set a Session Limit

When you tap "Connect," your wallet will ask you to confirm. Here you can also see how long the session will remain valid. TON Connect sessions expire, which is a safety feature. A typical session might last from a few minutes to several days. For a one-off interaction, choose the shortest time available. For a game you play regularly, a longer session is convenient, but remember that any session is a potential attack surface.

Step 6: Confirm a Small Test Transaction

Before you move any significant amount, send a small test transaction through the app. For example, if the app lets you swap tokens, do a tiny swap first. This verifies that the app is working correctly and that the connection is not secretly routing funds elsewhere. If the test fails or behaves oddly, do not proceed.

Step 7: sign out when done

After you finish using the Mini App, do not just close it. Go into the app's settings or the wallet's session list and disconnect. In Tonkeeper, you can find active sessions under "Settings" or "Connected Apps." In the Wallet bot, look for "Connected Sites." Disconnecting terminates the session and prevents the app from requesting future transactions without your explicit consent.

Red flags to reject immediately

A few patterns should make you end the connection process right away:

• The app asks you to "sync" your wallet by entering your seed phrase. No legitimate TON Connect interaction ever asks for this.
• The connection prompt shows an unknown domain. Even if the app name is plausible, the domain must match the official service.
• The app requests permissions that are not standard. For example, "read all transactions" or "manage your staking" are not typical for a simple connect.
• You are pressured to connect quickly. Scammers create urgency. A legitimate app will let you take your time.

What to do if something goes wrong

If you suspect you connected to a malicious app, act fast. Disconnect the session from your wallet immediately. Then, if you have already approved a transaction that sent funds, there is little you can do to reverse it on TON. Move any remaining funds in that wallet to a new wallet with a different seed phrase. Do not reuse the old address.

If the issue is a phishing prompt that appears to be from Telegram itself, do not click it. Report the Mini App to Telegram and delete it.

The Bottom Line

The connection itself is a secure handshake. The danger is in the steps around it: clicking the wrong link, approving the wrong transaction, or ignoring the domain. Always treat a Mini App as untrusted until you have verified its identity and understood what it is asking. A few extra seconds of review now can save you from losing everything later.

Back to ton