The pattern is old, and The Open Network (TON) just made it chatty. Someone — or a human-readable TON DNS name — invites you to send coins to a “drop” or “reward” address and put your wallet in the comment. The first transfer comes back with a tiny bonus. Encouraged, you send more. That one stays put. Support, if it answers, talks about checks, wallets that “cannot change mid-flight”, or a need to top up to a round dollar amount.
A confirmed transfer in a block explorer only means the coins reached their address. It is not a receipt for a future payout. TON DNS names resolve to wallets; they are not a seal of honesty. Security write-ups on TON phishing also warn about comment text that looks like an airdrop credit while you are signing something else entirely — so read the wallet prompt, not the marketing sentence.
Never join schemes that require you to send native coins to receive more of the same. If you already sent, stop, save txids and chats, and report through official help routes. No “admin of TON” will unlock the rest for a fee.
If you were caught by a send-more drop, start at Get help. Anyone selling a blockchain “rollback” afterward is covered on Fake recovery.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.