A single address poisoning operator has drained $9.4 million from 15 victims on the Tron network over the past four weeks, according to on-chain investigator Specter. The two largest victims each lost $2.5 million. The stolen funds were converted to USDD, a Tron-based stablecoin, and consolidated into a single wallet.
How Address Poisoning Works
Address poisoning attacks exploit the way blockchain addresses are displayed in wallet interfaces. Attackers send small amounts of cryptocurrency, called dust transactions, from fraudulent addresses that closely resemble addresses users have previously interacted with. Because most wallets display only the first and last few characters of addresses—MetaMask shows the first and last four of Ethereum's 42-character addresses—users often recognize addresses by these visible portions alone.
When victims copy what they believe to be legitimate addresses from their transaction history, they unknowingly send funds to the attacker's address instead. On August 22, investment firm Bofur Capital lost approximately $2 million using this method after an attacker sent 0.0002 USDC from a spoofed address 20 hours before Bofur initiated a genuine transfer from the lending platform Compound.
Wallet Protections Remain Limited
MetaMask and Trust Wallet have implemented defenses against address poisoning, but these protections function primarily on EVM-compatible chains such as Ethereum, BNB Smart Chain, and Polygon—not on Tron. MetaMask now alerts users when an address's first and last four characters match a previous recipient while the middle section differs.
Trust Wallet launched its Address Poisoning Protection feature in March, which compares incoming addresses against a database of known scam addresses and displays a side-by-side comparison if a match is found. According to Trust Wallet, the feature has detected over 225 million poisoning attempts, with more than $500 million in confirmed losses. This represents approximately 34,000 attacks per hour.
User Protection Measures
Until wallet providers implement comprehensive security features across all blockchain networks, users can protect themselves through manual verification practices. Users should verify every character in an address before sending funds, save trusted addresses in their wallet's address book rather than copying from transaction history, and send a small test transaction before transferring large amounts.
