Address Poisoning on TRON: How Look-Alike USDT Addresses Trick You

Address poisoning on TRON is a scam where, right after you pay someone, a different address that starts and ends like theirs sends you a tiny transfer. The look-alike now sits in your history next to the real one. If you later copy the recipient from that history, your USDT goes to the scammer, and a TRON transfer cannot be undone. The defense is simple: never take an address from your history, and check every character, not just the ends.

Below: real cases read from the chain on Nov 2, 2026, the math of making a look-alike, and a checklist.

How the scheme works

1. You send USDT to an address, say TWgsUN...BDXn73.
2. A bot watching the network sees it and picks or generates an address that matches some of the first and last characters.
3. Within seconds to a few minutes, that address sends you something: a few SUN of TRX, a few cents of real USDT, or a token with a familiar name.
4. Many wallets and explorers shorten addresses in lists to the first and last few characters. In that view the two entries look the same, and the fake one is the newest.

The scheme is a bet that one day you copy “the last address” instead of the right one.

Real cases from the chain

Data from the public TronGrid API; links open TronScan.

Dust TRX after an 18,042 USDT payment

On Nov 2, 2026 at 04:51:18 UTC, address THAbV7jZ...wAHUCf sent 18,042 USDT in block 87,640,529. Two “gifts” followed:

Paid to:        TWgsUNwYz6TFeqoGr2XpfaJuagjpBDXn73
+9 s, 7 SUN:    THuK3QLNade1KvAbFfD7vAjQeE81sAFt73
+63 s, 1 SUN:   TFfUfDCW3DazXFBvxWZCtYPezWDb3aZm73

Only “73” at the end matches. The first gift came three blocks later, the second 63 seconds after the payment. Each used 265 bandwidth from the free daily allowance and burned no TRX.

From Oct 22 to Nov 2, the same address made 8 outgoing USDT transfers, and every one was followed within five minutes by 1 to 5 transfers of 1 to 9 SUN: 23 in total, the first always 9 to 12 seconds after the payment. In 22 of the 23, the last two characters matched the address just paid; in 9, the last three did. None matched four, and at the start only one shared anything beyond the T.

A prepared twin that pays in real USDT

TErrT7545taY2zoctr6jtJ3W2xqepM6x7e is a busy address: it received 31 USDT transfers on Nov 1 alone. Someone made a twin of it:

Real:   TErrT7545taY2zoctr6jtJ3W2xqepM6x7e
Twin:   TErrT8zr5u2yx7JRUjMGcmXU4eCxpM6x7e

The first 5 and the last 6 characters match. On Oct 14 at 09:45:24 UTC, THAbV7jZ...wAHUCf paid the real address 1,006 USDT. 54 seconds later the twin sent it 1.006 USDT, the same digits. The twin’s full token history on Nov 2, 2026 holds 44 records: 22 gifts to 12 different addresses since May 16, 2026, 20.05 USDT in total, each funded 3 seconds earlier from one feeding address. Nobody else ever sent it USDT, so in that history no one fell for it. A second twin, TErrTyUPs3HauD6yyuUsSWKj5NjupM6x7e, matches the same 5 and 6 characters.

On Oct 21 the same payer sent 485 USDT to TMuCFzkE2ETDmEEkL7agsP98fpvN5ZPWDj and 39 seconds later got 0.6485 USDT from TMuCFMiDbz2Svk2yUE4TwsGL3P3x5ZPWDj: again 5 and 6 characters.

The case in our energy rental safety guide fits the cheap pattern: a 1 SUN transfer from TX2HiU...vMHd5 a minute after a payment to TEsPXd...GfPd5, with only “d5” in common.

How much work a look-alike takes

According to the account documentation, a TRON address is the last 20 bytes of the Keccak-256 hash of a public key with the byte 0x41 in front, shown as 34 Base58Check characters starting with T. An address cannot be chosen, only found by generating keys and testing each result. Base58 has 58 characters, so each matching character at the end divides the odds by 58.

The first character is always T, and because of the fixed 0x41 byte the second is one of 25 characters (9 to Z), two of them rare, so a match is about 1 in 23 (2^192 / 58^32 ≈ 23.3), not 1 in 58. Matching the first five characters takes about 4.6 million tries, not 58^5 = 656 million.

Model calculation; the speed is our own estimate from Nov 2, 2026: a single-thread Node.js script on an Intel Core i7-4790K made 2,036 TRON-format addresses per second, with SHA3-256 in place of Keccak-256 (key generation takes nearly all the time, so this barely matters). Specialized GPU software is much faster.

Characters that must match	Expected tries	Time at 2,036 per second
Last 2	3,364	under 2 seconds
Last 3	195,112	about 1.6 minutes
Last 4	11,316,496	about 1.5 hours
Last 5	656,356,768	about 3.7 days
Last 6	38,068,692,544	about 216 days
First 5 (T + 4)	4,553,521	about 37 minutes
First 5 + last 6, like the TErrT twin	about 1.7 × 10^17	about 2.7 million years

Hence the two tiers above: a 2 or 3 character match is made on the spot for any payment, while an 11-character twin is built in advance for an address many people pay, then reused for months.

Fake tokens and zero-value transfers

On Oct 18, 2026 THAbV7jZ...wAHUCf received 8,888 units of a token called “Gasfree U Transfer” from contract TWxt3jw2qm7kocH7agXtVqL7AJTPkC29rR. Anyone can name a token anything, including USDT. Real USDT on TRON has one contract, TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t; how to check it on a transaction page is in the TronScan guide, and what the token is in what USDT TRC-20 is.

Some guides also describe zero-amount transfers that appear “from your address”. In over 400 USDT transfer records we read for this article, none had a zero value. Every gift was real TRX or real USDT, so we do not describe that variant as a TRON pattern.

How to protect yourself

1. Copy the address from its source: the invoice, the deposit page, a confirmed message. Never from your history or an explorer list.
2. Check every character. Our twins matched up to 11 characters, never the middle. Compare in blocks of four or five.
3. Use an address book. Save a counterparty once, after checking it, and pick it from there each time.
4. Ignore the gifts. You cannot stop them and need not return them.
5. A test transfer is not a check. Gifts arrive after a test payment too. For the main payment take the address again from the source or the address book, not from the test in your history. A test costs a full transfer: if the recipient holds no USDT yet it uses 130,285 energy, about 13.03 TRX burned, or 3.41 TRX with rented energy at 26 SUN per unit for 1 hour as of Nov 12, 2026. The exact price is shown in the service before you pay; reference prices are on pricing, and why the first transfer costs double is in this guide.

For businesses

• Keep a whitelist of payout and withdrawal addresses, and let a second person approve every change to it.
• Make the payout system compare the full address with the stored record before signing, and never fill an address from recent transactions.
• Check new counterparty addresses before the first payout. UsdtPull offers AML checks of addresses and transactions and wallet tracking with USDT transfer notifications; see business services.

If USDT already went to the wrong address

A confirmed TRON transfer cannot be cancelled or reversed. Only the owner of the receiving address can send the USDT back, and a twin’s owner will not. What you can do:

1. Open the transaction on TronScan, confirm the recipient and save the hash.
2. Do not send anything more to that address, and do not pay anyone who promises to “recover” the funds.
3. If the address belongs to a platform you know, contact its support with the hash.
4. Tether’s terms say it may freeze tokens and blacklist addresses. That is Tether’s decision, and there is no procedure that guarantees a return.

FAQ

Does a gift from a look-alike address mean my wallet is hacked? No. Anyone can send to any address. The gift only plants an entry in your history.

Can I block incoming transfers on TRON? No. The protection is on the sending side: where you take the address from and how you check it.

Are payments to busy addresses targeted more? Our sample is too small to say. The 5 and 6 character twin above copies an address that received 31 USDT transfers on Nov 1. More answers are in the FAQ.