FreezeCheck
Address poisoning on TRON: 2.17 million look-alike addresses in a year
FreezeCheck research on the full USDT TRC-20 transfer stream over 55 weeks, 8 October 2025 — 28 October 2026.
2,172,676unique look-alike addresses in a year
5.08Mlure transfers to victims (0 USDT and dust)
130,013new fakes in the peak week, ending 17 Dec 2025
≈ 3,000new fakes a day now, 5× below the peak
17factories; the largest activated 43,661 fakes
27.5%of fakes carry a red tag on Tronscan
Key findings
- 2,172,676 unique look-alike addresses appeared on TRON in one year. Each copies the first and last characters of a real address the victim had already transacted with.
- Over 5 million lure transfers. The fakes sent victims 5.08 million dust and zero-value transfers to get into their transaction history.
- The peak was December 2025. 130,013 new fakes in the week ending 17 Dec 2025. Three days later, on 20 December 2025, came the largest known poisoning theft, on Ethereum rather than TRON: one user sent 49,999,950 USDT to an address copied from history (The Block).
- The wave has dropped five-fold. Now 22–25 thousand new fakes a week, about 3,000 a day. The first three months of observation averaged 107k a week, the last three 25k.
- It is an industry. 17 factories (activator wallets that funded 3+ fakes). The largest, TWkvff…98cdn, activated 43,661 fakes and received 239,587 USDT from eight of them in three weeks of October–November 2026: victims keep paying.
- The explorer does not warn. Only 27.5% of fakes in our sample carry a red tag on Tronscan. Seven out of ten look like ordinary addresses.
How poisoning works
- The victim regularly pays address A: an exchange, an OTC desk, a partner.
- The scammer generates A′ with the same 4–6 leading and trailing characters as A.
- A′ sends the victim 0 USDT or dust (0.001–1 USDT). The transfer shows up in history.
- Next time, the victim copies the "familiar" address from history, checks the first and last characters, and sends the money to A′.
- Funds move from A′ to the scammer's treasury. One treasury serves hundreds of fakes.
Method
- Source: all
Transferevents of the USDT TRC-20 contract per 201,600-block window (7 days), 55 windows, via SQD Portal. - Fake: an address that sent a recipient a zero or dust transfer and matches the prefix and suffix of another address the recipient transacted with in the same window.
- Victim: the recipient of such a lure. Factory: an address that activated (first funded) at least three fakes. Treasury: an address that received payments from at least three fakes.
- A fake active across several weeks is counted in each weekly window (3.55M records) and once in the total (2.17M unique addresses).
- We do not extrapolate losses. Direct victim payments to fakes over three weeks in October–November 2026 were at least 300,000 USDT in 522 transfers; one large recipient (a transit service with 1,112 senders, 0.5% of them fakes) was excluded as disputed.
What to do if you send or accept USDT
Checking the first and last characters is not enough: the fakes are built for exactly that habit. Compare the full address or verify it before sending. All 2.17M fakes are labelled in the bot: a fake scores 🔴 100 with the reason "look-alike of T…". Works inside any chat:
Check an address in the bot
@freezecheck_bot address.
For media and exchanges
Weekly data, the factory list and the method are available on request at hello@freezecheck.org. The full list of fakes is shared with exchanges and OTC desks after verification. Please link to this page when quoting. Our other research: unnamed exchanges on TRON, 2B USDT a week.
Practical guides: how to spot a look-alike address before you pay · how to check a USDT wallet · all research.