Tron Users Lose $9.4M to Address Poisoning Scam

A Tron wallet provider has fallen victim to a sophisticated scam known as address poisoning. An attacker sent tiny amounts of crypto from fake addresses that looked almost identical to real ones used by victims, causing them to send their money straight to the thief instead of the intended recipient.

The scammer, who has stolen $9.4 million from 15 victims over the past four weeks, swapped the funds into USDD, a Tron-based stablecoin, and moved them to one main wallet.

Investment firm Bofur Capital lost about $2 million to this exact trick on August 22. The attacker sent 0.0002 USDC from a fake address 20 hours before the real transfer.

While wallets like MetaMask and Trust Wallet have added protections against address poisoning, their safety features mainly work on EVM chains like Ethereum, BNB Smart Chain, Polygon, and so on, not Tron.

Users can protect themselves by verifying every character in the address and saving trusted addresses in wallet address books instead of copying from history. They can also send a small test transaction first when moving large amounts.