Address Poisoning on TRON: How the USDT Scam Works and How to Avoid It

Address poisoning is one of the most common ways people lose USDT on TRON — and it doesn't involve any hacking. Nobody steals your keys. The attacker simply gets you to copy the wrong address from your own transaction history. This guide explains how the attack works, how to recognise it, and the habits that make you immune.

How the scam works

1. You send USDT to a real address, for example your exchange deposit address TXyZb7Rq…8Kq4.
2. Within minutes, a bot generates a look-alike address with the same first and last characters — TXyZe1Tn…8Kq4 — and sends you a tiny or zero-value transfer from it, often in a fake "USDT" token.
3. That transfer now sits in your wallet history, right next to the real one.
4. Next time you pay, you copy the address from history. Wallets shorten addresses to the first and last characters, so the fake looks identical.
5. The USDT goes to the attacker — and TRON transfers can't be reversed.

Generating an address that matches 4–5 characters at each end takes a bot seconds. Matching the whole address is impossible — that's why checking the middle works.

Why TRON is a frequent target

• USDT transfers on TRON are frequent and large, so attackers can afford to "poison" thousands of addresses.
• Zero-value transfers and fake tokens cost very little to send.
• Many people pay the same exchange or partner address repeatedly and copy it from history.

Signs you've been targeted

• Tiny or zero-amount transfers you didn't expect, from addresses that look like ones you use.
• Unknown tokens named "USDT" or "USDT-TRC20" appearing in your wallet — check them with our USDT contract checker.
• Incoming transfers right after you made a payment.
• A transfer "from yourself" — the sender looks like your own address but isn't.

Being targeted doesn't mean your wallet is compromised. The attacker can't move your funds. The danger is only you copying their address.

How to protect yourself

• Never copy addresses from transaction history. Use your address book, a QR code or the original source (the exchange's deposit page, an invoice).
• Compare the whole address, not just the start and end. The middle characters give the fake away.
• Save frequent recipients in your wallet's address book with a name, and pick them from there.
• Send a small test transfer to a new or rarely used address first, and ask the recipient to confirm.
• Hide or ignore unknown tokens. Don't interact with airdropped tokens or visit links in their names.
• Check before large payments. Paste the recipient into our address check: a brand-new address with no history, when you expected your usual exchange, is a warning sign.

Address poisoning vs other scams

I already sent to a poisoned address — what now?

TRON transactions can't be reversed, and Tether only freezes funds on law-enforcement requests. What you can do:

1. Write down everything: transaction IDs, the poisoned address, the real one, times.
2. Report it to the exchange you use and to the platform where the funds were going — exchanges sometimes flag the attacker's address when funds arrive there.
3. For large amounts, file a police report. A freeze is only possible through official requests.
4. Ignore "recovery services". Many are scams that target victims a second time.

How to fix your wallet history

You can't delete transactions from the blockchain, but you can make them harmless: hide the spam tokens, add your real recipients to the address book, and stop using the history as a source of addresses.

Quick answers

Is my wallet hacked? No. Poisoning works without access to your wallet.

Should I move my funds to a new wallet? Not necessary because of poisoning alone. Do it if you've shared your phrase or signed something suspicious.

Do hardware wallets protect against it? Only if you check the full address on the device screen before confirming.