Address poisoning: how a look-alike gets into your history and how not to pay it

The most widespread way to steal USDT on TRON needs no hacking. The scammer simply waits for you to copy an address from your transfer history.

2,172,676look-alike addresses on TRON in a year

5.08Mlure transfers sent to victims

≈ 3,000new look-alikes every day

27.5%of look-alikes are tagged on Tronscan

The scheme in five steps

Step 1

You regularly pay address A

An exchange, an OTC desk, a supplier, a partner. The address sits in your history and you copy it from there because it is faster.

Step 2

The scammer makes address A′

They grind keys until they get an address with the same 4–6 leading and trailing characters as A. It takes minutes; "factories" stamp them out by the thousand.

Step 3

A′ sends you a lure

0 USDT or dust, 0.001–1 USDT. The transfer appears in your history next to the real ones.

Step 4

You copy the "familiar" address

You open the history, see an address with the right start and end, copy it and send. It is A′.

Step 5

The money goes to the treasury

It is swept from the look-alike to the scammer's wallet at once. One treasury serves hundreds of look-alikes. A TRON transfer cannot be reversed.

This is what a real address and its look-alike look like. The first and last characters match; the middle, which nobody reads, differs:

TTcpKj6zgcTGihxxRJSPd19xQKHgSqsYqT ← real

TTcpKxripBYHkuPF6RYM4UhARdgzSqsYqT ← look-alike

The scale

We processed the full USDT TRC-20 transfer stream for 55 weeks, from October 2025 to October 2026. In one year 2,172,676 unique look-alike addresses appeared on the network and sent victims 5.08 million lures. The peak came in December 2025: 130 thousand new look-alikes in a single week. Three days later, on Ethereum, one user sent 50 million USDT to a look-alike (The Block). The wave is now five times lower, but that is still about 3 thousand new look-alikes a day. Details, the weekly chart and the method: the research "2.17M look-alike addresses in a year".

Chart: new look-alike addresses on TRON per week, October 2025 to October 2026 — New look-alike addresses per week. Source: FreezeCheck.

Look-alikes are not made by loners. We found 17 "factories", wallets that activate look-alikes by the thousand. The largest launched 43,661 addresses and in three weeks collected 240 thousand USDT from eight of them. The scheme is working right now and victims keep paying.

Why the usual check fails

Most people compare the first and last four characters of an address. The look-alike is built for exactly that habit: those are the characters that match. The second false signal: the look-alike is in the history, so "I have sent here before". The third: on Tronscan seven out of ten look-alikes carry no tag at all and look like ordinary addresses.

One rule: compare the full address or verify it before sending. Do not copy the recipient's address from your incoming transfer history. Take it from the counterparty's message, from your wallet's address book or from the exchange's account page.

How to protect yourself

Save recipients in your wallet's address book and send only from there. A lure gets into the history, not into the address book.
Verify the address before a large transfer. Send it to @freezecheck_bot or type @freezecheck_bot address right in the chat. All 2.17M look-alikes are labelled: a look-alike scores 🔴 100 with the reason "look-alike of T…" and the real address it imitates.
A test transfer to a new address with confirmation from the recipient, then the main one. One fee more, one theft less.
Do not react to incoming 0 USDT. They cannot be "returned" and need no action, but they are a signal: someone is watching you and a look-alike is already in your history.
OTC desks and cashiers: check client addresses as a list, up to 50 addresses per file.

If you already sent to a look-alike

A TRON transfer is irreversible and technically cannot be returned. What you can do: save the transaction hash and the look-alike address, write to the exchange's support if the money went to a scammer's exchange deposit (exchanges sometimes freeze the account in time), file a police report, and write to Tether asking to freeze the look-alike and its treasury. The last step will not return the money but stops the scammer from withdrawing it. The bot shows the look-alike's treasury in the "Destination" section.

Verify an address before sending