FreezeCheck

ENRU

• EnglishEN
• РусскийRU
• TürkçeTR
• EspañolES
• PortuguêsPT
• Tiếng ViệtVI
• 中文ZH
• العربيةAR
• Bahasa IndonesiaID
• УкраїнськаUK

TRON wallet drained: approval and permission scams, and how to revoke access

USDT can leave a TRON wallet in three ways without a classic "hack": a token approval you signed, a change of account permissions, or a leaked seed phrase. Each one needs a different fix. Find out which one hit you, move what is left, revoke what can be revoked, and report the theft.

Paste the address that received your USDT, or the site's contract, into the field above. If it is a known drainer, you will see 🔴. FreezeCheck tracks 619 drainer addresses found by our own scans of the network.

How USDT is stolen without your seed phrase

1. Approval drainers

USDT on TRON is a TRC-20 token. The standard has a function called approve. It lets another address, usually a contract, spend your tokens up to a set amount. That address can then call transferFrom and move USDT out of your wallet without asking you again (TRON developer docs: TRC-20 interface). Approval is a normal tool: exchanges and DeFi apps use it every day.

A drainer abuses it. You land on a site that promises an airdrop, a "claim", a cheap swap or a "wallet verification". It asks you to sign one transaction. You think you are confirming a login. In fact you approve an unlimited amount of USDT for the drainer contract. Minutes or days later the contract takes your balance, and any USDT you receive later, while the approval stays active.

Fake tokens often start the chain. A token named "USDT" lands in your wallet, but it has a different contract. To "sell" or "claim" it you go to a site, and that site asks to approve your real USDT. Real USDT on TRON has the contract TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t. Anything else with the same name is not Tether.

2. Permission takeover

Every TRON account has permissions. The owner permission has full control, including the right to change the permissions themselves. Active permissions cover narrower sets of actions. Each permission lists addresses with weights and a threshold: a transaction is valid only when the weights of its signers reach the threshold. The change is made by an AccountPermissionUpdate transaction, and it costs 100 TRX (TRON developer docs: multi-signature).

Scammers use this to lock you out. Once they have your key, they do not always steal at once. They add their own address to the owner permission or replace yours. Your seed phrase still opens the wallet and shows the balance, but your signature alone is no longer enough. Transfers fail, often with an error like "SIGERROR". The address still receives money, so the scammer waits for you to top it up, then takes everything (imToken security alert, Nov 2026). The same trick can be done by a site that asks you to sign a "permission update" disguised as something else.

3. Leaked seed phrase and the "shared wallet" bait

The seed phrase leaks through fake wallet apps, fake "support" chats, phishing pages that ask you to "restore" or "sync" a wallet, or a photo in the cloud. With the seed, anyone can sign any transfer.

The reverse bait is common too. Someone "accidentally" posts a seed phrase in a chat, or a "friend" shares one. The wallet holds USDT but no TRX for fees. You send TRX to pay the fee, the transfer fails, and your TRX is gone. The account's permissions were changed long ago, and only the scammer can sign (TokenPocket: malicious multisig scams on TRON).

Which one happened to you

Open your address on Tronscan and look at the transactions before and during the theft.

Urgent steps

1. If the seed phrase leaked or permissions were changed: create a new wallet from a new seed phrase, on a clean device, in an official app. Do not import the old seed into it. If you can still move anything, move it to the new address right away. If the permissions were changed and your transfers fail, you cannot move funds out. Stop sending anything to that address, especially TRX "to unlock" it.
2. If only an approval was abused: the seed is safe, so revoke the approval (steps below). Until you do, do not send USDT to that address: the drainer will take it.
3. Save evidence: transaction hashes, the drainer's address, the site URL, chat screenshots, and the time.

Check and revoke approvals

Tronscan has a built-in tool for this. According to Tronscan, you can view all approved contracts on the account page in the list of approvals, cancel any of them, and see the approval change history (Tronscan: Cancel Contract Approval; also "Account Details > Approval").

1. Open tronscan.org and connect your wallet with the "Connect Wallet" button, for example TronLink.
2. Open your account page and find the approvals section (Approval).
3. Look at every spender with a USDT allowance. Anything you do not recognise, or anything "unlimited" to a contract you no longer use, should go.
4. Cancel the approval and confirm the transaction in your wallet. It sets the allowance to zero.
5. Check the list again after the transaction is confirmed.

Some wallets have their own approval manager. The menu name differs by app and version, so if you cannot find it, use Tronscan.

Where the stolen USDT goes

A drainer rarely keeps the money. USDT moves from the drainer contract to the operator's wallet, then through one-off pass-through wallets, and often ends at an exchange deposit or an OTC desk. If it reaches an exchange deposit address, that exchange knows the account owner and can be asked to hold the funds.

FreezeCheck shows this route. Check the drainer's address in @freezecheck_bot. The "Destination" button shows where USDT went, up to 5 hops, with labels such as "Binance deposit" or "drainer". The graph draws the whole picture, and the PDF packs it into a document you can attach to a police report or a letter to an exchange.

Report the theft

• Police. File a report with the hashes, addresses and the FreezeCheck PDF. Without a case number, exchanges and Tether rarely act.
• Tether. Tether can freeze USDT on an address, but it does so on legitimate law enforcement requests, after legal proceedings and risk assessment (Tether: law enforcement and financial freedom). Tether's knowledge base sends thefts, hacks and scams to its information requests team (tether.to). In practice, the request comes from your police case, not from you.
• The exchange. If the money reached a deposit address, write to that exchange's support with the hashes and the case number.
• Tronscan and Chainabuse. Report the drainer address, contract, token or site on Tronscan (how to report a scam) and on Chainabuse. This warns the next victim.

What not to do

• Do not pay "recovery services". People who write to you after a theft and promise to return funds or "unlock" permissions for a fee are the second wave of the same scam. TokenPocket puts it bluntly: anyone claiming they can restore a hijacked multisig wallet is a scammer.
• Do not share your seed phrase or private key. Not with "support", not with a revoke tool, not with anyone. A real revoke never needs it.
• Do not send TRX to a wallet you cannot control, your own or one from a "shared seed".
• Do not keep using the old wallet after a seed leak or permission change.

How to avoid it next time

• Read what you sign. "Approve", "increase allowance", "update permissions" or "owner permission" in a request means stop.
• Keep a separate wallet with a small balance for dApps. Keep savings in another wallet, ideally on a hardware wallet.
• Install wallets only from official sites and stores. Never type your seed into a website.
• Review approvals on Tronscan from time to time and remove old ones.
• Before you connect to a site or send USDT, check the contract or recipient. In any Telegram chat type @freezecheck_bot T… and get a verdict in seconds.
• Turn on "Watch" for your wallet in the bot to get alerts about it.
• Copy addresses from a trusted source, not from your history: see address poisoning.

FAQ

See also: address poisoning: how not to pay a look-alike, how to check a USDT wallet before you trade, USDT frozen on TRON: what to do.