Address poisoning on TRON: at least 89 million USDT sent to look-alike addresses

FreezeCheck research on every USDT TRC-20 transfer from 20 December 2023 to 10 November 2026. We counted the payments that went to a look-alike address instead of the one the sender had paid before.

89.0M USDTsent to look-alike addresses, a lower bound

3,894mistaken payments from 3,833 wallets

3,200 USDTmedian loss; one in ten is 40,000 or more

4.5M USDTlargest payment, under a minute after a lure

6.4 hoursmedian time before the money moves on

0 of 3,817look-alike addresses frozen by Tether

Bar chart: USDT sent to look-alike addresses on TRON per month, December 2023 to November 2026. Peak of 10.5 million in March 2024; 5.3 million in April 2026 and 4.7 million in October 2026. — USDT sent to look-alike addresses per month. Data: monthly CSV, CC BY 4.0.

Key findings

At least 89.0 million USDT in under three years. 3,894 payments of 10 USDT or more from 3,833 wallets went to 3,817 look-alike addresses. The counting rules are strict, so this is a lower bound: in a multi-victim TRON case reported publicly in August 2026, 10.2M in stablecoins reached the collection wallet, and the payments that pass these rules account for 1.8M of it.
Fewer victims, the same money. 2024: 2,155 payments, 33.9M USDT. 2025: 1,247 payments, 27.6M. 2026 to 10 November: 449 payments, 26.9M. About five times fewer payments than in 2024 and almost the same sum.
A few large payments carry the total. The median loss is 3,200 USDT. 165 payments of 100,000 USDT or more make up 55.2M (62%); 9 payments of 1M or more make up 21.0M (24%).
The largest: 4,500,000 USDT on 22 March 2024, less than a minute after a lure arrived. The same wallet had sent 5M USDT to the real address two minutes earlier.
Three characters at the start, five at the end. In almost all cases the fake matches the real address in the first 3–4 characters after T and the last 5–7. The most common match, 3 and 5, accounts for 2,077 payments.
Half the mistakes come within a day. Median time from the last lure to the mistaken payment is about 25 hours; 20% happen within an hour, 49% within a day.
Many notice at once. In 1,552 cases (23.4M USDT) the victim then sent the same amount to the real address.
Tether froze none of the 3,817 look-alike addresses that received the money.

What the attack costs

About 41.7 million lure transfers in the period, 1.8% of all USDT transfers on TRON. The share fell from 6.3% in 2023 to 0.6% in 2026.
Zero-value lures almost disappeared: 570 thousand in the last days of 2023 against 50 thousand in all of 2026. The typical lure is now 1–5 USDT of real money.
A lure costs 16 times more than in 2023: $0.15 in 2023, $0.50 in 2024, $1.16 in 2025, $2.35 in 2026.
Every lure is its own transaction, with no batching and no intermediary contracts. 67% of lure transactions pay no fee: 99% of the energy comes from staked or rented resources.
Twenty senders account for 48.6% of all lures; the top four for 25.5%.
The return is $0.7–2.6 per dollar spent. Attackers spent between $34.9M (burned fees plus dust given away) and $135.8M (all energy priced at the burn rate) to take $89.0M. In 2026 the range is $1.4–2.7 per dollar.

Where the money goes

It moves within hours. In 2,762 of 3,894 cases the look-alike address sent the money on within 7 days, 85.7M USDT in total. Median time to the first move: 6.4 hours; a third in under an hour.
A quarter goes straight into the USDT-to-USDD swap contract. 318 payments, 20.2M USDT (25% of the first-hop total), went from the look-alike address into the Peg Stability Module of the USDD stablecoin, contract TSUYvQ5tdd3DijCD1uGunGLpftHuSZ12sQ. USDT, which Tether can freeze, is exchanged there for another stablecoin in one transaction. The contract is a public service open to anyone, not a scammer's wallet. The first such payment was on 3 February 2025; in 2026 this route took 200 of 449 mistaken payments.
The rest of the first hop. The first hop has 339 recipients and 80.1M USDT in total, the swap contract included. Besides it: addresses with no label 38%, decentralised exchange routers 21%, large services with no public name 8%, addresses linked to already flagged wallets 7%.
One first-hop recipient was frozen later: 172 thousand USDT from 8 payments.

Method

Source: all Transfer events of the USDT TRC-20 contract via SQD Portal, 20 December 2023 to 10 November 2026.
A payment counts when: the recipient is a look-alike address that sent the payer a lure before the payment; the payer had a real transfer of 10 USDT or more with the original address; the payment is 10 USDT or more.
Excluded: 287 payments (4.0M USDT) where the pair is the payer's own address or a regular counterparty, and 495 unclear repeats (9.3M USDT).
Independent re-check: 500 payments (the 200 largest and 300 random, 60.7M USDT, 68% of the total) were compared with TronGrid transaction events. 500 of 500 matched in sender, recipient, amount and time.
Lure counts and costs are estimated from a sample: four 100-block windows per week, 608 windows. A lure is a zero-value or below-10-USDT transfer from a look-alike address.
Scope: TRON, USDT, payments of 10 USDT and more.

Related work

Tsuchiya, Dong, Soska and Christin, "Blockchain Address Poisoning" (USENIX Security 2025), measured Ethereum and BNB Chain: 270 million attack transfers, 6,633 incidents, at least $83.8M lost. We found no published measurement of losses on TRON.

What to do if you send or accept USDT

Checking the first and last characters is not enough: the fakes are built for exactly that habit. Compare the full address or verify it before sending. The bot shows when an address is a look-alike of another one. Works inside any chat: @freezecheck_bot address.

Check an address in the bot

For media and exchanges

Monthly data and the method are available on request at hello@freezecheck.org. Please link to this page when quoting. Related: 2.17 million look-alike addresses in a year · who Tether freezes on TRON, and who it doesn't.

Practical guides: how to spot a look-alike address before you pay · how to check a USDT wallet · all research.