Address poisoning on TRON: at least 89 million USDT sent to look-alike addresses

Originally published by FreezeCheck at freezecheck.org. Data under CC BY 4.0. Prepared with the help of AI tools; all figures come from our on-chain data.

FreezeCheck research on every USDT TRC-20 transfer from 20 December 2023 to 10 November 2026. We counted the payments that went to a look-alike address instead of the one the sender had paid before.

89.0M USDT — sent to look-alike addresses, a lower bound

3,894 — mistaken payments from 3,833 wallets

3,200 USDT — median loss; one in ten is 40,000 or more

4.5M USDT — largest payment, under a minute after a lure

6.4 hours — median time before the money moves on

0 of 3,817 — look-alike addresses frozen by Tether

USDT sent to look-alike addresses per month. Data: monthly CSV, CC BY 4.0.

Key findings

• At least 89.0 million USDT in under three years. 3,894 payments of 10 USDT or more from 3,833 wallets went to 3,817 look-alike addresses. The counting rules are strict, so this is a lower bound: in a multi-victim TRON case reported publicly in August 2026, 10.2M in stablecoins reached the collection wallet, and the payments that pass these rules account for 1.8M of it.
• Fewer victims, the same money. 2024: 2,155 payments, 33.9M USDT. 2025: 1,247 payments, 27.6M. 2026 to 10 November: 449 payments, 26.9M. About five times fewer payments than in 2024 and almost the same sum.
• A few large payments carry the total. The median loss is 3,200 USDT. 165 payments of 100,000 USDT or more make up 55.2M (62%); 9 payments of 1M or more make up 21.0M (24%).
• The largest: 4,500,000 USDT on 22 March 2024, less than a minute after a lure arrived. The same wallet had sent 5M USDT to the real address two minutes earlier.
• Three characters at the start, five at the end. In almost all cases the fake matches the real address in the first 3–4 characters after T and the last 5–7. The most common match, 3 and 5, accounts for 2,077 payments.
• Half the mistakes come within a day. Median time from the last lure to the mistaken payment is about 25 hours; 20% happen within an hour, 49% within a day.
• Many notice at once. In 1,552 cases (23.4M USDT) the victim then sent the same amount to the real address.
• Tether froze none of the 3,817 look-alike addresses that received the money.

What the attack costs

• About 41.7 million lure transfers in the period, 1.8% of all USDT transfers on TRON. The share fell from 6.3% in 2023 to 0.6% in 2026.
• Zero-value lures almost disappeared: 570 thousand in the last days of 2023 against 50 thousand in all of 2026. The typical lure is now 1–5 USDT of real money.
• A lure costs 16 times more than in 2023: $0.15 in 2023, $0.50 in 2024, $1.16 in 2025, $2.35 in 2026.
• Every lure is its own transaction, with no batching and no intermediary contracts. 67% of lure transactions pay no fee: 99% of the energy comes from staked or rented resources.
• Twenty senders account for 48.6% of all lures; the top four for 25.5%.
• The return is $0.7–2.6 per dollar spent. Attackers spent between $34.9M (burned fees plus dust given away) and $135.8M (all energy priced at the burn rate) to take $89.0M. In 2026 the range is $1.4–2.7 per dollar.

Where the money goes

• It moves within hours. In 2,762 of 3,894 cases the look-alike address sent the money on within 7 days, 85.7M USDT in total. Median time to the first move: 6.4 hours; a third in under an hour.
• A quarter goes straight into the USDT-to-USDD swap contract. 318 payments, 20.2M USDT (25% of the first-hop total), went from the look-alike address into the Peg Stability Module of the USDD stablecoin, contract TSUYvQ5tdd3DijCD1uGunGLpftHuSZ12sQ. USDT, which Tether can freeze, is exchanged there for another stablecoin in one transaction. The contract is a public service open to anyone, not a scammer's wallet. The first such payment was on 3 February 2025; in 2026 this route took 200 of 449 mistaken payments.
• The rest of the first hop. The first hop has 339 recipients and 80.1M USDT in total, the swap contract included. Besides it: addresses with no label 38%, decentralised exchange routers 21%, large services with no public name 8%, addresses linked to already flagged wallets 7%.
• One first-hop recipient was frozen later: 172 thousand USDT from 8 payments.

Method

• Source: all Transfer events of the USDT TRC-20 contract via SQD Portal, 20 December 2023 to 10 November 2026.
• A payment counts when: the recipient is a look-alike address that sent the payer a lure before the payment; the payer had a real transfer of 10 USDT or more with the original address; the payment is 10 USDT or more.
• Excluded: 287 payments (4.0M USDT) where the pair is the payer's own address or a regular counterparty, and 495 unclear repeats (9.3M USDT).
• Independent re-check: 500 payments (the 200 largest and 300 random, 60.7M USDT, 68% of the total) were compared with TronGrid transaction events. 500 of 500 matched in sender, recipient, amount and time.
• Lure counts and costs are estimated from a sample: four 100-block windows per week, 608 windows. A lure is a zero-value or below-10-USDT transfer from a look-alike address.
• Scope: TRON, USDT, payments of 10 USDT and more.

Related work

Tsuchiya, Dong, Soska and Christin, "Blockchain Address Poisoning" (USENIX Security 2025), measured Ethereum and BNB Chain: 270 million attack transfers, 6,633 incidents, at least $83.8M lost. We found no published measurement of losses on TRON.

What to do if you send or accept USDT

Checking the first and last characters is not enough: the fakes are built for exactly that habit. Compare the full address or verify it before sending. The bot shows when an address is a look-alike of another one. Works inside any chat: @freezecheck_bot address.

Check an address in the bot

For media and exchanges

Monthly data and the method are available on request at [email protected]. Please link to this page when quoting. Related: 2.17 million look-alike addresses in a year · who Tether freezes on TRON, and who it doesn't.

Practical guides: how to spot a look-alike address before you pay · how to check a USDT wallet · all research.

More FreezeCheck research

• Tether unfroze 731 TRON addresses and burned $318.6M
• Tether freezes on TRON are visible before they happen
• Who Tether freezes on TRON, and who it doesn't
• Unnamed exchanges on TRON: $2B in USDT a week
• Address poisoning on TRON: 2.17M look-alikes in a year

FreezeCheck checks a TRON USDT wallet before a deal: @freezecheck_bot. Full study, method and CSV: freezecheck.org.