Key takeaways
- Dormancy is the single largest gap in a wallet's funding history. It counts as a documented silence once the gap reaches 180 days — the threshold TRONORIGIN uses — and the telling detail is the address that woke the wallet up.
- A takeover is a divergence: the address that created the wallet and the address that runs it now are different parties. That divergence sorts into one of five kinds.
- The kind is decided by what the new leader holds — an owner key reads as a sale, delegation as a secondary wallet, nothing at all as a compromise.
- A separate flag catches the sale where the leadership never changed on paper because the seller kept the keys and only the money trail moved.
A wallet that has sat silent for two years and then receives a fresh deposit deserves more attention than the deposit alone would earn. On a chain where control travels with a private key and nothing else, a long silence followed by new activity is one of the clearest shapes a change of ownership leaves behind.
Reading that shape well is the difference between “an old account got funded” and “this account may have changed hands,” and the reactivation of a dormant wallet has its own forensic machinery for it: a measure of the silence, a signal for whoever broke it, and a takeover classification for when the wallet’s creator and its current operator turn out to be different parties. This article covers how each piece works and how to read the result without overstating it. It builds on the origin-versus-control split described in One Wallet, Two Answers; a takeover is what happens when those two questions return different answers.
What dormancy is, mechanically
The measurement is the single largest gap between consecutive transactions in the wallet’s sorted funding history. An old account with steady activity has no dormancy at all — age and dormancy are different things. That longest quiet stretch counts as a documented silence only when it reaches at least 180 days; anything shorter is ordinary irregular activity. The chain has no concept of a dormant account — dormancy is an analyst’s yardstick, and the day-counts used to grade it here (180, 365, and 730 days) are TRONORIGIN’s own thresholds, not protocol constants or an externally published standard.
The measure runs over the wallet’s inbound funding history, with DEX-router traffic filtered out first — the gap describes silence in who funds the wallet rather than a lull in its own outbound moves. When the gap qualifies, the detail to record is the reactivating entity, the sender of the first funding transaction after the silence.
One marker stands apart: a gap of a year or more is long enough that the quiet stretch alone warrants a second look. Nothing follows from it automatically, though — it is an observation. The real work happens where dormancy meets control.
Reactivation is a control signal
The reactivating entity earns a second role when it is also one of the addresses funding the wallet: it becomes evidence about control. Waking a dormant wallet speaks to who runs the account now, so it belongs with the current-control picture and says nothing about the separate origin question of who first brought the account online.
How much that evidence weighs scales with the length of the silence:
| Silence before reactivation | Evidentiary weight |
|---|---|
| 180 days or more | Notable — a genuine documented silence, broken |
| Two years (730 days) or more | Considerably heavier — a very long dormancy makes a fresh hand on the wheel much harder to explain innocently |
Keep the three markers distinct, because they do different jobs: 180 days is where a gap first counts as a documented silence and the reactivation begins to carry weight; at 365 days TRONORIGIN treats the silence alone as worth a second look; by 730 days the reactivation weighs heaviest. The finding itself stays small — a first funder arriving after an extended gap. It tells you who broke the silence, and it feeds the question the next section takes up: whether the wallet’s operator is still the party that created it.
A takeover is a divergence
Two named roles carry the definition. The genesis leader is the party in control over roughly the account’s first 30 days; the operational leader is the party in control over roughly the last 180 days. In forensic terms, a takeover is the specific, measurable case where those two are different, non-null addresses: the account was brought online by one party and is run by another.
A raw divergence is not enough to raise the flag, because thin evidence produces noisy disagreements. Two tests hold it back. One is a margin test: the operational leader has to out-control the genesis leader by a clear margin, and a narrow lead reads as a potential takeover only. The other sets the confidence: the more lopsided the evidence between the two — the wider the gap in how strongly each controls the account — the firmer the reading, from Medium for a modest gap up to High for a decisive one. When the genesis leader shows no control evidence at all and the operational leader has some, the gap is effectively unbounded; that limiting case gets flagged as exactly that instead of being forced onto a number. Only a divergence that passes both tests reads as a takeover.
The five kinds of takeover
Once a takeover clears both tests, it classifies by a single question, asked in a fixed order: what the new operator holds.
| The operational leader holds… | Kind | Reading |
|---|---|---|
| An owner permission key | Sale | Controlled handoff; the new party can sign. High confidence. |
| An active key only (no owner key) | DAO transition | Controlled, scoped handoff. Medium. |
| A resource-delegation basis | Secondary wallet | An operational sibling rather than a new owner. Medium. |
| No key or delegation, but matches the reactivator | Hostile | The party that broke the silence now runs the wallet with no continuity of relationship. Medium. |
| None of the above | Compromise | Control moved with no visible basis at all. Low. |
The order is doing real work. Keys are checked before the dormancy match, so an operator who holds the owner key is read as a sale even if it was also the reactivator — a documented key gives a benign explanation for a divergence that would otherwise look hostile. Only when there is no key, no delegation, and the new leader is the address that woke the wallet does the classification reach the hostile branch.
One case is deliberately kept out of the hostile branches. A lone energy sponsor — an address whose only tie to the wallet is delegated resources, holding no key and not part of a coordinated delegate-and-undelegate cluster — is read as a secondary wallet rather than an attacker. Energy delegation is a native protocol feature — under Stake 2.0 an address can fuel another wallet’s transactions without moving value or handing over a key, so a lone energy sponsor holds no signing right and pays nothing into the wallet. A resource sponsor is therefore not a funder and not, on that basis alone, an owner. That benign reading is withheld only when the delegation is part of a coordinated sybil-rotation swarm, where the pattern is a genuine attack shape. Energy delegation as an ownership signal is the subject of Who Pays the Fees?.
The sale nobody rotates keys for
The takeover types above all require a visible divergence — the operational leader has to differ from the genesis leader. But the cleanest wallet sale leaves no such divergence, because the seller hands over the private key and the on-chain leadership never changes. The creator’s address is still the one signing; there is nothing for takeover detection to catch.
This case needs its own signal. When the genesis leader and the operational leader are the same address — no takeover on paper — but a different entity has dominated the wallet’s funding history with strong evidence, that entity reads as a suspected buyer, and the wallet gets flagged as a possible retained-key sale. The reasoning: someone new is now paying into a wallet whose keys never moved, which is what a quiet key-handover sale looks like from the outside. The evidence bar has to sit deliberately high — the funding entity must be a genuinely dominant payer, not merely present — because a loose bar for this reading fires almost unconditionally.
This is a different pattern from the sale takeover kind, and the distinction matters. A sale is a visible handoff: control diverged and the new party holds a key. A retained-key sale is an invisible one: control never diverged on-chain because the keys stayed put, and only the money trail betrays the change. The key-rotation side of ownership change — where a creator is explicitly stripped from the permission keys — is covered in Same-Permission-Key Detection.
Why a sale can be invisible
Whoever holds an account’s owner permission controls it absolutely, and when no explicit permission structure is set, the account’s own address holds owner permission by default — which is to say control is the private key. Handing that key to a buyer transfers everything, and the chain records nothing, because no transaction took place. The address keeps signing; only the person behind it changed.
That is why behavioral divergence is the only residue such a sale leaves. The seller can rotate the keys with an on-chain permission update, which is visible, or keep them and walk away — in which case the sole evidence is a new party funding and operating an account whose creator has gone quiet. The dormancy, takeover, and retained-key methods above exist to surface that residue.
Reading it as an investigator
A note on method: the underlying reasoning here is reproducible by any analyst on-chain — control travels with the owner key (see Sources), and a takeover is simply the case where the account’s creator and its current operator are different parties. But the specific framework used to grade and label that divergence — the ~30-day genesis and ~180-day operational windows, the margin it requires and its Medium-to-High grading of how firm the reading is, and the five-kind classification — is TRONORIGIN’s own methodology and calibration, not a protocol constant or an externally published standard. Read the labels as this project’s grading of the evidence, not as chain-defined facts.
Treat every one of these findings as a lead, not a verdict. A takeover flag means the data suggests control changed hands; it does not mean anything malicious happened, and a sale or secondary-wallet reading is a routine, benign explanation for a divergence. Weight the kind by its confidence. A high-confidence sale backed by an owner key is a firm reading, while a low-confidence compromise with no visible basis mostly says keep digging. And a possible retained-key sale means exactly what the phrase says — a possibility raised by a funding-trail change, one that needs corroboration before anyone calls it a proven transfer.
The forensic value here is that a wallet’s history remembers what its current state cannot show. An account that woke up after two years, funded by a new party with no key and no prior relationship, is telling you something its balance and permission snapshot alone never would. Reading that silence, and what broke it, is how a change of hands becomes visible on a chain that records none of it.
Sources
- TRON Developer Hub — Multi-Signature — the owner-permission model underpinning why control travels with the private key: owner permission as the highest account privilege, and the default-to-self rule when no explicit permission structure is set, which is what makes an off-chain key handover leave no on-chain trace.
- TRON Developer Hub — Account model and types — the TRON account model the dormancy measure is grounded in: what a TRON account is and how it is activated, the substrate over which the inbound-funding-gap yardstick (disclosed below) is computed.
- TRONORIGIN attribution methodology (proprietary) — the dormancy machinery itself is the project’s own calibration, not a protocol constant or an externally published standard (as the article states): the single-largest-gap measure over inbound funding history, the 180 / 365 / 730-day grading thresholds, and the takeover classification that compares genesis-era evidence against recent evidence.