← All articles

Investigation

Address Poisoning: Lookalike Attacks, Dust Bursts, and How TRONORIGIN Penalizes Them

PUBLISHED │ READ~12 min │ BYTRONORIGIN

security address-poisoning dust-attacks lookalikes

On December 20, 2025, a single copy-paste mistake cost a crypto trader $49,999,950. The victim made a $50 test transfer to confirm a destination, then copied what appeared to be the same address from their history and sent the rest. It was not the same address. An attacker had seeded the victim’s history with a lookalike — an address sharing the first six and last four characters of the real counterparty. The funds were gone from TRON in under thirty minutes, through Tornado Cash before any intervention was possible.

This is address poisoning: not a smart contract exploit or key compromise, but a social engineering attack against the habit of copying from transaction history rather than a trusted address book. TRON, with its enormous USDT-TRC20 volume and near-zero fees, became the dominant venue for this attack.

The attack in one paragraph

An attacker identifies a target wallet and one of its regular counterparties — someone the target has sent funds to before. Using a GPU-accelerated brute-force key search, the attacker generates a fresh private key whose corresponding address shares the first six and last four base58 characters of the legitimate counterparty. The attacker then sends a zero-value or micro-dust transfer from that lookalike address to the target. The poisoning address now appears in the target’s transaction history. When the target next intends to pay that counterparty, they open their history, see the familiar prefix and suffix, copy the address, and paste it into their wallet. They send to the attacker. The legitimate counterparty never receives funds.

The three forms

Address poisoning on TRON arrives in three distinct forms. They are often layered.

Lookalike addresses with prefix/suffix matching

The core of the attack is brute-force address generation. A TRON address is 34 base58 characters, beginning with T. Most wallet interfaces display only the first six and last four characters, with ellipsis filling the middle. An attacker does not need a perfect address match — only a match on the characters that are actually shown. A 6/4 prefix/suffix match is tractable in seconds on GPU hardware (see the compute section below). The middle 24 characters differ entirely, but are never visible to the victim.

Zero-value transfers

TRON’s TRC-20 standard allows any address to call the USDT contract’s transfer method with a value of zero. The transaction costs almost nothing in Energy, the sender appears in the recipient’s transaction history alongside a USDT transfer entry, and no value moves. From the victim’s perspective, their history shows an interaction with what looks like the legitimate counterparty — at a timestamp close enough to the real transaction that it blends into the sequence.

Zero-value transfers are the cleanest form of poisoning because they require no TRX dust, produce no balance change in the victim’s wallet, and appear in USDT transaction history rather than TRX transaction history. This matters: many wallet interfaces list TRC-20 transfers separately from native TRX activity, and users may not notice the difference.

Micro-dust bursts

The third form uses sub-dust TRX transfers — amounts below 0.01 TRX, often as small as 1 SUN (0.000001 TRX) — from the lookalike address to the victim. At TRON’s current transaction costs, an attacker can sustain a campaign of hundreds of dust bursts across thousands of target addresses for roughly $40 worth of TRX. TRM Labs documented one active dusting address in mid-2025 that had made approximately 920 outgoing transactions — all micro-dust, all from an address resembling its targets’ counterparties.

Micro-dust serves a secondary purpose: it keeps the poisoning address visible in the wallet’s recent activity feed even as real transactions accumulate. Zero-value TRC-20 transfers can be filtered by some interfaces; a native TRX transfer, however small, is harder to suppress.

Why TRON specifically

Three structural features combine to make TRON the dominant venue for this attack.

Volume and target density. USDT-TRC20 settled approximately $2.04 trillion in Q1 2026 at 4.5 million transactions per day. Monitoring the mempool for large USDT transfers and poisoning the sender’s history immediately after each one is a continuous, automated operation. The pool of high-value targets never empties.

Near-zero cost. TRON’s Energy-staking model means an attacker with a TRX stake can send thousands of dust transactions daily for effectively nothing. The December 2025 TRM Labs–documented campaign of 920 outgoing dust transactions cost roughly $40 in TRX. Ethereum’s gas model makes equivalent campaigns orders of magnitude more expensive.

No protocol defense against lookalikes. A TRON address includes a base58check checksum, but that checksum only detects corruption in the address bytes — it cannot detect visual similarity between two different valid addresses. Any 34-character string beginning with T that passes the checksum is a legitimate TRON address. The lookalike is fully valid on-chain.

For the full breakdown of USDT-TRC20’s architecture and scale, see /learn/usdt-on-tron/.

How attackers generate the lookalike

Lookalike address generation is a brute-force search problem: generate private keys, derive the corresponding TRON address, check whether the address prefix and suffix match the target pattern, and repeat until a match is found.

The search space for a 6/4 prefix/suffix match (six leading characters plus four trailing characters) is approximately 58^10, or roughly 430 billion combinations. This sounds large, but GPU hardware is well-suited to this computation. High-performance TRON vanity address generators using CUDA or OpenCL on a NVIDIA V100 achieve approximately 2.2 billion hash operations per second. At that rate, a 6/4 prefix/suffix match takes on the order of three to six seconds of wall time. A 7/4 match (seven leading characters, four trailing) takes roughly 90 to 180 seconds — still within the window of a fast mempool-monitoring pipeline.

The attack infrastructure is automated end to end. Tsuchiya et al. (USENIX Security 2025, arXiv 2501.16681) documented 270 million on-chain poisoning attack attempts targeting 17 million victim addresses — 13 times more than previously estimated. Modern operations use smart contracts to fan-fund hundreds of attacking addresses in a single transaction.

Lookalikes are pre-generated and pooled. When the attacker’s monitoring bot detects a large USDT transfer, the pre-staged lookalike fires its poisoning transaction within seconds of the legitimate transfer landing. No real-time generation is required.

How TRONORIGIN detects and penalizes them

TRONORIGIN’s heuristic (v5.1.0) applies a layered detection and penalty model specifically designed to neutralize poisoning candidates from contaminating attribution results.

Signal 1 — Levenshtein lookalike detection. Every sender in the transaction history is compared against the target address itself using Levenshtein edit distance. Senders within edit distance ≤ 3 of the target are immediately flagged as target lookalikes and assigned HIGH poisoning risk. A sender that is a near-copy of the target has no legitimate reason to appear in the history. The heuristic also compares senders against each other to identify prefix/suffix clusters — groups sharing first and last character patterns from a common brute-force campaign.

Signal 2 — Zero-value transfers as candidates. Zero-value TRX transfers are excluded from candidate scoring entirely in the V3.4 heuristic, and zero-value TRC-20 transfers from suspicious addresses are penalized directly. The HAS_ZERO_VALUE_TRANSFERS behavioral tag is applied to any wallet whose history contains zero-value TRX transfers, and the POTENTIAL_ADDRESS_POISONING_V4 tag fires when multiple poisoning indicators are present together.

Signal 3 — Micro-dust detection tier. The V5.1 heuristic introduced a dedicated micro-dust tier for transfers below 0.001 TRX (1,000 SUN). Two or more micro-dust transfers from a candidate address escalate that candidate to MEDIUM poisoning risk. The dust threshold for scoring was also lowered from 1 TRX to 0.01 TRX in V5.1 to match real-world attack patterns; anything below that floor receives a −5 amount penalty in addition to poisoning risk escalation.

Score penalties — direct and confidence-band. Suspicious candidates receive direct score deductions plus confidence-band reductions:

Risk levelScore deltaConfidence effect
HIGH−15Reduce by 2 bands (unless definitive signal present)
MEDIUM−8Reduce by 1 band (unless definitive signal present)

When HIGH risk is detected, the first-sender bonus (+10) is suppressed (FIRST_SENDER_BONUS_SUPPRESSED tag). Poisoning addresses frequently attempt to appear as the first transaction in a history — a position that would otherwise receive that bonus.

Definitive signal override. AccountCreateContract (+100) and resource delegation (+50) override poisoning-driven confidence reductions. An attacker sending dust cannot forge either signal.

For the full scoring weight table and confidence threshold logic, see /how-it-works/.

What an investigator should look for

When reviewing a wallet’s transaction history for poisoning attempts, the pattern is recognizable once you know what to check.

The address shape. Pull the full address of any suspicious entry — not the truncated version. If the first six and last four characters of the candidate closely match a known legitimate counterparty while the middle 24 characters differ entirely, that is the fingerprint of brute-force generation. On Tronscan, expanding the full address of every recent transaction in the history is the single most effective manual check.

Activity profile of the candidate. A poisoning address almost never has a legitimate use history. Created minimally funded, fired once or a few times, then quiet — with no resource delegations, no staking, no return flows, and no outbound activity to the victim beyond the poisoning event itself. A legitimate counterparty will have a real on-chain history.

Timing relative to real transactions. Poisoning attempts typically arrive within minutes of a real transaction in the victim’s history. The attacker’s mempool-monitoring bot fires the dust the moment it detects the legitimate transfer. Look at the block timestamps: if a suspicious entry appeared 30 seconds to two minutes after a real large USDT transfer, it was almost certainly triggered by that transfer.

First-funder pattern on the candidate address. If you have access to an attribution tool, run the poisoning candidate through it. Legitimate counterparties have legitimate funding histories. Poisoning addresses are typically funded by the same infrastructure used to fund other poisoning addresses — part of a coordinated campaign. TRM Labs and Chainalysis maintain cluster datasets covering known address poisoning operators; comparing the candidate’s first funder to those clusters can confirm attribution to a known attacker.

A real example

The December 20, 2025 incident illustrates the full sequence without identifying victims.

The target regularly transacted with a counterparty. The attacker had previously identified that relationship, pre-generated a lookalike of the counterparty address (sharing its first six and last four characters), and staged it for deployment.

The trigger: the victim sent a $50 USDT test transfer to the real counterparty — a common practice before a large payment. Within minutes of that test transaction confirming, the attacker’s bot fired a dust transfer from the pre-staged lookalike to the victim’s wallet. That address now appeared in the victim’s USDT history at nearly the same timestamp as the test transfer, its prefix and suffix indistinguishable from the real counterparty in truncated view.

The victim then executed the main transfer: $49,999,950 USDT to the lookalike.

The funds moved within seconds to a relay address, were swapped from USDT to DAI (removing them from Tether’s freeze reach), converted to approximately 16,690 ETH, and deposited into Tornado Cash — all within 30 minutes. The poisoning address itself held funds for seconds. The victim sent an on-chain message offering a $1 million bounty. No funds were returned.

What investigators tracing victim funds need to know

The poisoning relay address itself almost never holds funds. Within seconds of receipt, stolen USDT moves onward — to a consolidating wallet one level removed from the relay, then quickly to a non-freezable asset. The conversion-to-TRX route bypasses Tether’s blacklisting mechanism (which applies to the USDT contract, not TRX itself). The bridge-out route — typically to Ethereum or BSC — appears as a TRON outbound and an Ethereum inbound at nearly the same timestamp. From Ethereum, Tornado Cash is the documented next step.

The December 2025 case ran from victim transfer to Tornado Cash in under 30 minutes. Law enforcement notifications sent hours later had no on-chain intervention opportunity. The only realistic windows are real-time alerting or the victim immediately contacting their exchange to flag the destination.

If you run the relay address through a TRONORIGIN Full Analysis scan, expect Low confidence, TOKEN_ONLY scoring (no legitimate funding relationships), and behavioral tags consistent with an automated account. The relay’s own first funder is typically part of the attacker’s campaign infrastructure — compare it against known poisoning operator clusters from TRM Labs or Chainalysis to confirm attribution.

Sources