Glossary · TRONORIGIN

A

ABI (application binary interface)

The specification of a smart contract's functions, arguments, and data encodings — the machine-readable map that tells callers how to package a call and tells observers how to decode one. Without a contract's ABI, its call data and event logs are opaque bytes; with it, they read as named functions with typed arguments. Because standard interfaces such as the fungible-token standards fix their ABIs, explorers can decode a token transfer's real recipient and amount even on contracts whose source code was never published.

Abstention (unknown as answer)

Reporting no controller or origin when the evidence does not support one, rather than naming the least-unlikely candidate. In forensic and intelligence practice, an inconclusive result is a legitimate finding; a guessed attribution is worse than none because downstream decisions inherit its false confidence.

Account activation

On TRON, a newly derived address does not exist on-chain until an existing account activates it — by transferring TRX or TRC-10 tokens to it, by creating it explicitly with an account-creation transaction, or by a smart contract transferring value to it. Until activation the address is just a valid key pair with no state, and the activating account (which pays a small creation cost) is the new wallet's first on-chain relationship.

Account model (vs UTXO)

A ledger design — used by Ethereum, TRON, and most smart-contract chains — in which each address has a single mutable balance that transactions increment and decrement. There are no discrete coins, so the ledger keeps no built-in record of which inbound funds an outbound transfer spends; any lineage through an account-model address is an analyst's accounting convention. Not to be confused with the UTXO model, where value exists as discrete outputs with verifiable ancestry.

Account permission

TRON records who may act for an account directly in on-chain account state: one owner permission and up to eight active permissions, each a list of weighted keys — each key recorded as a TRON address, not a raw public key — with a threshold. Reading this structure answers, from the ledger itself, who can authorize transactions for the account right now.

Account takeover

A divergence between an account's origin and its current operator: the party who created and funded the wallet is no longer the party controlling it. Takeover can be hostile (key theft, permission hijack) or consensual (a sale or handoff), and detecting it means an origin inference alone no longer answers who acts for the account today.

AccountCreateContract (type 0)

TRON's explicit account-creation transaction type (ContractType 0), in which an existing account creates a new address on-chain and is permanently recorded as its creator. Because the transaction names creator and created directly, it is the strongest possible genesis evidence — not inferred from funding patterns but stated in the ledger itself. Most new accounts are instead activated implicitly by a first transfer of TRX or a TRC-10 token, so when a type-0 transaction appears it records a deliberate, attributable act of creation.

AccountPermissionUpdate (type 46)

The single TRON transaction type (ContractType 46) that rewrites an account's permissions — its owner and active key lists, their weights, and the thresholds they must meet. Because no other operation can alter permission state, every change of signing control passes through a type-46 transaction, stamping each handoff, hardening, or hijack with an exact on-chain date. An account's type-46 history is therefore a complete, ordered changelog of who has been able to sign for it.

Active permission

A delegated permission on a TRON account that can authorize only the transaction types enabled in its operations field, a bitmask with one bit per contract type. An account may configure up to eight active permissions, so an owner can grant, for example, transfer rights to an operational key without surrendering the power to change permissions.

Address

A public identifier, derived from a key pair, at which an account receives funds and is looked up on-chain. Anyone can view an address's history, but only the matching private key can spend from it. TRON addresses are 34-character Base58Check strings beginning with "T".

Address clustering

The technique of grouping multiple addresses believed to be controlled by the same entity, based on evidence such as shared signing keys, common funding sources, deposit patterns, or coordinated behavior. Clustering turns a scatter of unrelated-looking addresses into a picture of one operator, but every grouping rests on a heuristic — a cluster is a hypothesis whose strength is only as good as the rule that built it.

Address format (T… vs 0x…)

The per-chain encoding convention that makes an address recognizable at a glance: TRON uses 34-character Base58Check strings starting with "T", while Ethereum and other EVM chains use 40 hexadecimal characters prefixed "0x". The format tells an analyst which chain's ledger holds the history — and because TRON and Ethereum share the same key scheme, one key pair corresponds to both a "T…" address and a "0x…" address (TRON's hex form is the Ethereum address with a 41 prefix).

Address label / tag

A human-readable name — an exchange, a service, a known scam — attached to a blockchain address by an outside observer such as an explorer, an analytics provider, or a community submitter. The label lives off-chain and is only as reliable as whoever assigned it: labels can be wrong, stale, or self-assigned, so the labeler's methodology is part of the evidence.

Address poisoning

An attack in which an adversary plants a look-alike address — generated to match the first and last characters of a real counterparty — in a victim's transaction history, usually via zero-value or dust transfers, so that the victim later copy-pastes the wrong address and sends funds to the attacker. Not to be confused with the poison rule, a taint-accounting convention in fund tracing that shares nothing but the name.

Airdrop

A distribution of tokens to many wallet addresses at once, typically free and often unsolicited, used to promote a project or reward past activity. Because recipients need not act — or even know — to receive one, an airdropped token in a wallet's history is weak evidence of any relationship between sender and recipient. Attackers exploit the same mechanic to plant scam tokens.

B

Bandwidth

A TRON network resource that covers the byte-size cost of putting a transaction on chain — one byte consumes one Bandwidth point. Every account receives a small free daily allowance (also called free bandwidth); heavier usage requires staking TRX, receiving a delegation, or burning TRX to cover the bytes.

Base58Check (address encoding)

The encoding that turns a TRON address's raw bytes into the familiar string beginning with "T": the 20-byte public-key hash is prefixed with 0x41, a 4-byte checksum (derived by hashing the payload twice with SHA-256) is appended, and the result is written in Base58 — an alphabet that deliberately omits the look-alike characters 0, O, I, and l. The checksum means a mistyped address is overwhelmingly likely to be rejected as invalid rather than silently paid. The same bytes also have a hex spelling starting "41", which is why one TRON account can appear two ways: "41…" in raw transaction data, "T…" in wallets and explorers.

Behavioral co-movement

A soft clustering signal in which several addresses act in lockstep — transacting in the same bursts, at the same hours, with similar amounts, tempo, or counterparties — suggesting one operator or one automated system behind them. Unlike a shared signing key or a common funder, co-movement is purely statistical: it accumulates suspicion rather than establishing control, and independent actors reacting to the same external event can mimic it. It is best used to corroborate other clustering evidence, not as a standalone attribution.

Block

A batch of transactions committed to the chain together, carrying a timestamp and the hash of the previous block — the link that chains blocks into a tamper-evident sequence. On TRON, the elected Super Representatives take turns producing a new block every 3 seconds.

Block explorer

A public website that renders blockchain data readably: paste in an address, transaction ID, or block number and see balances, token holdings, transaction history, and decoded contract activity. Explorers add convenience layers on top of raw node data — entity labels, token logos and metadata, decoded call data — and those layers are the operator's editorial additions, not part of the ledger, so they carry the operator's errors and omissions. Tronscan is the principal explorer for TRON.

Blockchain

A shared ledger maintained by many independent computers, in which transactions are grouped into blocks and each block cryptographically references the one before it. Because rewriting any past entry would break every link after it, the record is effectively append-only — new entries can be added, but history cannot be quietly altered.

C

Call data

The encoded payload of a contract call: a short function selector followed by the encoded arguments, telling the contract which function to run and with what inputs. In a token transfer the transaction's visible recipient is the token contract itself — the real recipient and amount sit inside the call data — which is why decoding it is essential to reading token movements.

Cash-out / off-ramp (laundering)

The final stage of a laundering pipeline: converting cryptocurrency — very often a stablecoin by this point — into spendable fiat money through exchanges, over-the-counter desks, payment processors, or peer-to-peer buyers. Cash-out is where illicit flows are most exposed, because the fiat side runs through institutions with identity checks and records reachable by legal process. Much of the structure that precedes it — layering, chain-hopping, mixing — exists to make the funds arriving at this stage look unremarkable.

Centralized exchange (CEX)

A company that custodies customer funds and matches trades on its own internal books rather than on the blockchain. Only deposits and withdrawals touch the chain; everything in between happens inside the exchange's private ledger, which is why an on-chain trail typically goes dark at an exchange boundary. Contrast with a decentralized exchange (DEX), where trades execute on-chain via contracts.

Chain analysis

The discipline of studying public blockchain data to cluster addresses, attribute them to real-world entities, and follow flows of value — combining what the ledger states with heuristics, behavioral patterns, and off-chain reference material such as labels, leaks, and court filings. The term names the methodology generically, independent of any vendor. Its outputs span a spectrum from certainty (what the ledger records) to hypothesis (what a clustering rule infers), and rigorous work keeps the two visibly distinct.

Chain hopping

The laundering technique of moving value across blockchains — through bridges, cross-chain swaps, or withdrawing from a service in a different asset — so that no single chain's ledger contains the full trail. Each hop forces an investigator to re-join the trail manually, typically by matching amounts and timing at the crossing point; rapid movement between chains and assets is a recognized money-laundering red flag.

Circular / self-funding flow

A flow pattern in which value leaves an address and later returns to it, directly or through a loop of intermediary addresses, making the same party both the sender and the ultimate recipient. Circular flows are a common-control indicator: unrelated parties rarely route funds back to their source, so a closed loop suggests the intermediate hops belong to one operator. The pattern also appears in activity-faking schemes, where an operator cycles the same balance repeatedly to simulate genuine traffic.

Coin vs token

A coin is a chain's native asset, built into the protocol itself and used to pay for the chain's resources — TRX on TRON, ETH on Ethereum, BTC on Bitcoin. A token is issued on top of a chain, its balances recorded by a contract (or, for TRC-10, a protocol asset record) rather than in the protocol's native accounting. The distinction is mechanical, not cosmetic: a USDT balance on TRON is an entry inside the USDT contract's storage, moved by contract calls that consume Energy, while a TRX balance is protocol state moved by a simple transfer.

See also: TRX , Token , TRC-20 , Smart contract

Cold storage / cold wallet

A wallet — also called a cold wallet — whose private keys are generated and kept on devices never connected to the internet, used to hold reserves rather than process daily flows. On-chain it reads as the opposite of a hot wallet: large balances, few counterparties, and infrequent large transfers to or from operational wallets.

Commingling

Merging funds from different sources into a single balance so that outgoing transfers can no longer be attributed to particular incoming ones. It happens routinely and legitimately — exchange consolidation wallets pool thousands of customers' deposits — and deliberately, as a laundering technique. Commingling is the reason taint-propagation rules exist: once value is pooled, any claim about which outflow carries which inflow is a convention, not a fact.

Confidence band

A qualitative tier — Low, Medium, or High — summarising how strongly independent lines of evidence converge on the same conclusion. High means multiple unrelated signals agree; Low means the evidence is sparse, ambiguous, or contradictory. Banded confidence is standard practice in assessment disciplines because it communicates the strength of a finding without implying false numeric precision.

Confirmation

Each block produced after the one containing a transaction counts as a confirmation, and every additional confirmation makes reversal less likely, because undoing the transaction would mean rewriting more of the chain's history. Services scale their confirmation requirements to their exposure before crediting a deposit. On TRON the operative concept is solidification: once roughly two-thirds of the Super Representatives have built on a block (about 19 blocks, under a minute), it is final — reversal is no longer merely unlikely but outside the protocol's rules.

Consolidation wallet / collector

A wallet — also called a collector or omnibus wallet — where a custodial service pools funds swept from many customer deposit addresses. Once funds arrive, individual customers' balances exist only in the service's internal records; on-chain the money is commingled and indistinguishable, so tracing an individual through it requires those internal records.

Contract account

An account whose behavior is governed by deployed code rather than a private key. It has an address and can hold balances like any other account, but nobody signs on its behalf — it acts only when its functions are called, doing exactly what its code dictates. Contrast with an externally-owned account, which is controlled by whoever holds its key.

Control vs ownership

The distinction between who can sign transactions from an address (control) and who holds the economic claim to the funds it contains (ownership). A custodial service controls addresses whose balances belong to many customers, so identifying the controller of an address does not establish whose money it is. Not to be confused with origin vs control, which contrasts who created or funded an address with who can sign for it now.

Counterfeit token / fake USDT

A token contract deployed to imitate a real token's name and ticker symbol — "fake USDT" is the classic case — with no issuer, backing, or redeemability behind it. Anyone can deploy a contract bearing any name and symbol, so a token's authenticity is established only by its contract address, never by its label.

Current control

Who can move an account's funds right now — answered not by inference but by reading the account's permission state: the keys listed in its owner and active permissions and the thresholds their weights must meet. Current control is the "now" half of the origin-versus-control distinction: origin (who created and funded an account) must be inferred from history and can go stale, while current control is stated in the ledger and changes only through a recorded permission update.

Custodial hop / boundary

The point in a fund flow where value passes into or out of a service that holds keys on customers' behalf — an exchange, payment processor, or other custodian (sometimes just called an intermediary). Crossing the boundary (a custodial hop) breaks direct on-chain traceability: inside the service, funds move on internal books, so what later emerges on-chain cannot be tied to a specific depositor from ledger data alone. The intermediary's own records — often reachable by legal process — are what carry a trace across the boundary.

Custodial vs non-custodial

The dividing line in who holds the keys. In a custodial arrangement a third party — an exchange or hosted-wallet service — controls the private keys to your funds; in a non-custodial arrangement (self-custody) you hold your own keys and sign your own transactions. The distinction determines who the real on-chain actor is behind any address.

Custody / custodian

An arrangement in which one party — the custodian — holds the private keys or reserves controlling assets that belong to others. On a blockchain, whoever holds the keys is the on-chain owner: custodied funds sit under the custodian's addresses, so the entity an analyst sees acting on-chain is the custodian, not the customer.

D

dApp

A decentralized application — an app whose core backend logic runs as smart contracts on a blockchain rather than on a company's servers. The user-facing website or interface is ordinary software, but the actions that matter (moving funds, recording state) execute on-chain, where anyone can inspect them.

Decentralized exchange (DEX)

An exchange implemented as smart contracts: traders swap tokens directly from their own wallets against on-chain liquidity, so no operator ever takes custody of funds. On TRON the principal DEX is SunSwap — formerly JustSwap, rebranded in 2021 when Sun.io absorbed it, so older on-chain activity against JustSwap contracts belongs to the same protocol.

DeFi

Decentralized finance — financial services (trading, lending, borrowing, earning yield) delivered by smart contracts that hold funds and enforce terms directly on-chain, with no bank or broker as intermediary. Anyone with a wallet can interact with a DeFi protocol, and every position and movement is publicly recorded.

Delegated Proof of Stake (DPoS)

A consensus design in which coin holders do not validate blocks themselves but vote — with weight proportional to their stake — to elect a small, fixed set of block producers. TRON runs a DPoS system in which the 27 top-voted candidates become the Super Representatives that produce blocks, re-elected at regular intervals, which trades some validator decentralization for fast, cheap blocks.

Deposit sweep

The routine, usually automated transfer a custodial service uses to move funds out of individual customer deposit addresses into a central collection wallet. A sweep typically empties the deposit address shortly after funds arrive; many addresses draining into the same collector is a recognizable service pattern, not evidence about any individual customer. Also simply called a sweep.

Deposit-address clustering

A clustering heuristic that groups addresses by where their funds are collected: when many addresses each forward their balances into the same collector, those addresses are almost certainly the per-customer deposit infrastructure of one service, or holdings of one operator. It is among the stronger behavioral heuristics because sweeping into a common collector is an operational act of whoever controls the addresses — depositors could not produce it by coincidence. False merges remain possible where unrelated parties share a payment processor or forwarding service.

Dormancy / dormant revival

A prolonged silence in an account's transaction history — no signed activity for an extended stretch — followed by a sudden resumption. The revival itself is a forensic event: whoever signs the reactivating transaction provably holds the key at that moment, and long-dormant funds that abruptly move warrant scrutiny for key compromise, a sale, or a controller returning. What counts as "long" is a judgment call relative to the account's own rhythm, not a fixed number of days.

Dusting

Sending tiny or zero-value transfers to addresses the sender does not control, so that the sender plants itself in their transaction histories. The purposes vary: seeding a look-alike address for a later copy-paste mistake (address poisoning), tagging wallets so their subsequent movements can be watched, or inflating an address's counterparty count to muddy analysis. The underlying lesson is that inbound activity is unauthenticated — anyone can send anything to any address — so dust must be filtered out before a transaction history is read as a map of real relationships.

Dwell time

How long funds rest at an address between arriving and moving on. Dwell time separates roles: a wallet that holds value for weeks reads as storage or savings, while an address whose funds leave within minutes is a pass-through — a hop in a route rather than a destination. Short, uniform dwell times repeated across many transfers point to automation, and combined with flow shape they help classify an address as an endpoint or as infrastructure.

E

Energy

A TRON network resource that meters the computational cost of smart-contract execution, consumed whenever a transaction calls contract code — including TRC-20 token transfers such as USDT. An account obtains Energy by staking TRX or receiving a delegation from another account; if it holds too little, the shortfall is paid by burning TRX from its balance.

Energy marketplace / rental

A service that delegates staked Energy to paying customers, letting them run TRC-20 transfers and other contract calls far more cheaply than burning TRX for each one. The renter pays a fee and receives temporarily delegated Energy; ownership of the underlying staked TRX never changes hands. The tracing consequence is easy to misread: an inbound delegation from a marketplace is a purchase made by the wallet's operator, not evidence that the marketplace controls or funds the wallet.

ERC-20 (token standard)

Ethereum's fungible-token standard: a contract interface fixing a common set of functions (transfer, approve, transferFrom, balanceOf) and events (Transfer, Approval) so that every conforming token behaves identically for wallets, exchanges, and tooling. TRON's TRC-20 standard is a deliberate copy, which is why token mechanics on the two chains — allowances, transfer events, decimal scaling — read the same and why analysis concepts carry over directly. The name comes from Ethereum Request for Comments 20, the 2015 proposal by Fabian Vogelsteller and Vitalik Buterin.

See also: TRC-20 , Token , Approve / allowance , Transfer event

Event log

A record a smart contract emits during execution, stored alongside the transaction: the emitting contract's address, indexed "topics" used for filtering, and a data payload. Logs are the durable public trace of what a contract did — a TRC-20 transfer's real recipient and amount live in its Transfer event, not in the transaction's outer fields. Contracts cannot read logs back; they exist for outside observers, which makes them the primary raw material for token accounting and tracing.

EVM (Ethereum Virtual Machine)

Ethereum's execution engine — the specification of the state machine that runs compiled smart-contract code, guaranteeing that every node computes identical results from identical transactions. The EVM became a de-facto standard well beyond Ethereum: chains that implement a compatible machine can run the same compiled contracts and reuse the same developer tooling. TRON's TVM is one such compatible implementation, which is why Solidity contracts and their forensic artifacts — call data, event logs, ABIs — look alike on both chains despite entirely different fee models.

Exchange deposit address

An address a centralized exchange generates and assigns to one customer for inbound deposits. Because the exchange holds the private key, on-chain the address belongs to the institution, not the depositing customer — funds sent there attribute to the exchange, and identifying the customer behind a specific deposit requires the exchange's internal account records.

Externally-owned account (EOA)

An account controlled by a private key held by a person or organization, as opposed to a contract account controlled by code. The term comes from Ethereum, but the distinction applies on TRON too: every externally initiated transaction begins with an EOA's signature, so tracing who acts on a chain ultimately means tracing EOAs.

F

Fan-in / fan-out

Two complementary flow shapes: fan-in, where many addresses send to one (a collector pattern), and fan-out, where one address sends to many (a distributor pattern). Both are signatures of infrastructure rather than personal wallets — deposit sweeps, payout batches, airdrop distributions — and both complicate tracing by merging or splitting value at a single point.

Fee limit

A caller-set ceiling, denominated in TRX, on how much a contract call may spend on Energy — fixed at the moment the transaction is signed. If execution would cost more, it halts and its state changes are rolled back, but the resources consumed up to the stop are still charged. The fee limit is the signer's own declaration of what the call is worth to them, so habitual fee-limit values can act as a small behavioral fingerprint of the wallet software or operator constructing the transactions.

Finality (solidified block)

The point at which a block can no longer be reverted under normal network conditions. On TRON a block becomes final — a solidified block — once more than 70% of the 27 Super Representatives (19 of them, each a different producer) have built on top of it, which at three-second blocks takes roughly a minute; exchanges and services typically credit a transaction only after its block solidifies.

First funder

The address that made the first meaningful inbound value transfer to a wallet, establishing its earliest economic relationship. It is a strong origin signal — someone chose to be the first to put value into the wallet, usually close in time to its creation. On TRON the signal is amplified: a new address must be activated by an existing account (typically via its first TRX or TRC-10 transfer), so the first funder is often also the account's on-chain creator.

First outbound

An account's first outgoing transaction — the earliest act on record that was provably performed by whoever held the account's keys. Inbound history can be planted by anyone (dust, spoofed transfers, unsolicited deposits), but sending requires a signature, so the first outbound is where an account's authenticated behavior begins: its timing, destination, and construction reflect the controller's own choices. Comparing first inbound with first outbound also brackets when the operator demonstrably had signing access.

See also: First funder , First sender , Signature , Dusting

First sender

The chronologically first address to send any transaction to a wallet, regardless of value. It is a weaker signal than the first funder because it is cheap to game — an attacker can plant a zero-value or dust transfer so that a look-alike or unrelated address appears first in the history. Not to be confused with first funder, which requires a meaningful transfer of value.

Freeze vs seizure

A freeze is an administrative act by a token's issuer: the contract immobilizes an address's balance, and the issuer can typically reverse it. A seizure is a legal act by a state: ownership of the assets is transferred under a court order or forfeiture process. The two often occur in sequence — an issuer freezes on request, and destruction or reissuance follows only when a legal order authorizes it — but they answer to different authorities and have different reversibility.

Fueling / fee provision

Any arrangement in which an outside party keeps a wallet transacting without its holder paying the network costs — by delegating staked resources, topping up small amounts of the native coin for fees, or sponsoring transactions through a fee-payment service; also called fee sponsorship. Not to be confused with funding lineage: fueling explains who pays a wallet's running costs, not where its balance came from.

Funding lineage

The traced chain of where an address's balance came from — its funders, their funders, and so on, hop by hop backward through the ledger. Lineage answers "whose money seeded this wallet". Not to be confused with fueling or fee sponsorship, which supply the resources or fees a wallet needs to transact without necessarily being the source of its balance.

G

Gas

Ethereum's unit for the computational effort a transaction consumes: every operation costs a set amount of gas, and the fee paid is gas used multiplied by a market-driven per-unit price, which both compensates validators and prevents spam and runaway execution. TRON prices the same costs differently — it splits them into two staked resources, Energy for computation and Bandwidth for transaction bytes, rather than one auctioned fee unit.

Gas abstraction / GasFree

Mechanisms that let a user send tokens from a wallet holding none of the chain's native coin, with a third-party provider paying the network fee — typically the user signs an authorization message off-chain, and the provider submits and executes it, taking its fee in the token being sent. On TRON, GasFree is a flagship implementation aimed at USDT transfers from TRX-less wallets. Gas abstraction changes what fee payment means in analysis: the account submitting or funding the transaction is a service provider, so fee-payer links stop implying common control.

Genesis block

The first block of a blockchain — block 0, with no predecessor — from which every later block descends. TRON's genesis block was produced on 25 June 2018, which is why no TRON address can show native on-chain history from before that date.

See also: Blockchain , Block , Token migration / swap

GENIUS Act

The Guiding and Establishing National Innovation for U.S. Stablecoins Act, signed into US law on 18 July 2025 — the first federal framework for payment stablecoins. It requires permitted issuers to hold full reserves, treats them as financial institutions under the Bank Secrecy Act, and mandates that any issuer (including foreign issuers whose coins trade in the US) possess the technical capability to seize, freeze, or burn its stablecoins and comply with lawful orders to do so — making issuer-level intervention power a legal requirement rather than an optional design choice.

Governance proposal

An on-chain motion to change one of TRON's network parameters — fee prices, resource economics, feature switches. Proposals are raised within the Super Representative candidate set (the body sometimes called the committee), and only the 27 Super Representatives holding active seats at the time may vote; ordinary holders influence outcomes indirectly, through the staked votes that elect those seats. An adopted proposal changes its parameter at a recorded moment, which is why TRON's fee and resource behavior falls into distinct dated eras.

H

Haircut rule (taint)

A proportional taint-accounting convention: when tainted and clean funds are spent together, each output inherits taint in proportion to the tainted share of the inputs. A 100-unit payment drawing on a balance that is 30% stolen value carries 30 tainted units. The haircut conserves total tainted value through any number of splits and merges — unlike the poison rule, which marks everything touched as fully tainted — at the cost of tracking ever-thinner fractions as funds disperse and commingle.

Hard fork

A backward-incompatible protocol change: nodes that do not upgrade reject the new rules, so the network can split into two chains sharing one history up to the fork point. Every holder at the fork-snapshot block ends up with equal balances on both chains — often described as a 1:1 airdrop — as with Ethereum/Ethereum Classic in 2016 and Bitcoin/Bitcoin Cash in 2017. For an analyst, a forked balance is new value that appeared without any inbound transfer.

I

Internal transaction

A value transfer or call that a smart contract makes while executing, nested inside the outer transaction that triggered it — also called an internal tx. Internal transactions carry no signature and no separate fee of their own, because they are effects of contract code rather than independently authorized actions; a complete trace of value movement must therefore include them, not just the top-level signed transactions.

Issuer-controlled token

A token whose contract reserves privileged functions — freeze or blacklist, mint, burn, pause, or confiscate — for its issuer, placing the issuer's authority above every holder's. Most major reserve-backed stablecoins are issuer-controlled: holding one is holding a claim the issuer can honor, freeze, or extinguish at the contract level.

K

Key pair (public/private key)

A mathematically linked pair — a private key that signs transactions, and a public key (with the address derived from it) that lets anyone verify those signatures. Whoever holds the private key controls the address: on a blockchain, ownership is key control, whatever any off-chain record says. "Keypair", "private key", and "public key" all refer to parts of this same structure.

See also: Signature , Address , Wallet , Seed phrase

L

Layering

The middle stage of the classic three-stage money-laundering model: moving illicit value through a sequence of transactions, addresses, services, assets, and chains so the trail back to the source becomes long, branched, and expensive to follow. On-chain layering typically combines rapid pass-through hops, splits and re-merges, mixers, token swaps, and chain-hopping. Its weakness on a public ledger is permanence — every hop is recorded forever, so layering buys delay and cost rather than erasure, and the trail can be re-walked whenever one gap (a mixer match, a subpoenaed custodian) is closed.

Ledger

A record of balances and transactions that its users treat as authoritative — the core abstraction beneath all bookkeeping, from a bank's internal databases to a blockchain. A blockchain is a distributed ledger: one whose copies are held by many independent nodes and kept consistent by a consensus protocol instead of a single bookkeeper. When funds enter a custodial service they move off the public ledger and onto the custodian's private one, which is why traceability changes character at that boundary.

Liquidity pool

A smart contract holding reserves of two or more tokens that traders swap against directly, with prices set by a formula rather than by matching buyers to sellers. Liquidity pools are the building block of automated market makers; the depositors who fill them earn a share of trading fees.

Liquidity provider (LP)

A participant who deposits a pair of tokens into a liquidity pool so others can trade against it, receiving pool-share tokens (LP tokens) that entitle them to a proportional cut of trading fees and to withdraw their slice of the pool. Providing liquidity is passive market-making. For flow analysis, LP deposits and withdrawals are exchanges with a contract rather than payments to a counterparty: value entering a pool re-emerges as a redeemable claim, and the pool address itself is shared plumbing used by everyone.

M

Mass funder / distribution wallet

An address that sends transfers to a very large number of distinct recipients — a distribution wallet. The pattern marks infrastructure (exchange hot wallets, payout systems, airdrop distributors) rather than a personal counterparty, so receiving from a mass funder says little by itself about who owns the receiving wallet. What counts as "very many" is a judgment made relative to the population under study, not a fixed number.

Mint / burn

Minting creates new token units and credits them to an address; burning permanently destroys units, typically by sending them to an unusable address or calling a contract function that reduces supply (a "coin burn"). Together they are how issuers expand and contract a token's supply — stablecoin issuance and redemption, wrapped-token creation, and deflationary fee schemes all run on mint-and-burn mechanics.

Mixer / tumbler

A service (also called a tumbler) that pools deposits from many users and pays recipients out of the common pool, deliberately breaking the on-chain link between sender and recipient. The severed trail can sometimes be re-joined by matching amounts and timing around the mixer, and U.S. guidance has treated custodial mixing itself as money transmission since 2019.

Money laundering (3-stage)

The process of disguising the criminal origin of funds so they can be used openly, conventionally described in three stages: placement (introducing illicit value into the financial system), layering (moving it through transactions and intermediaries to obscure the trail), and integration (spending or investing it as apparently legitimate wealth). On a public blockchain the layering stage leaves a permanent record, which is precisely what transaction tracing works against.

Money market (lending)

A pooled lending protocol: suppliers deposit assets into a shared contract to earn interest, and borrowers draw from the pool against collateral worth more than their loan, facing forced liquidation if its value falls too far. Interest rates float algorithmically with how much of the pool is borrowed. JustLend DAO is TRON's flagship money market. Deposits typically mint receipt tokens representing the supplier's claim, so a balance that seems to have vanished from a wallet often sits inside a lending contract, redeemable at will.

See also: DeFi , Liquidity pool , Smart contract

Multi-signature

An authorization scheme — commonly shortened to multisig — in which signatures from multiple private keys are required before a transaction is valid, removing any single key as a point of failure or unilateral control. On many chains multisig requires deploying a special contract wallet; on TRON it is native, because every account's permission structure supports weighted multi-key signing against a threshold.

Multisig threshold

The minimum summed key weight a permission on a TRON account requires before it can authorize a transaction. Each key in the permission carries a weight, and a transaction is valid only when the combined weight of the keys that actually signed meets the threshold — so a threshold higher than any single key's weight forces multiple signers to cooperate.

N

Native vs bridged

A distinction in how an asset exists on a chain: a native asset is issued directly there by its issuer or protocol, while a bridged asset is a locally minted stand-in backed by the original locked on another chain, holding value only as long as the bridge honors redemption. The two carry different risk and different provenance — a bridged token's true issuer and reserve live on the other chain. Paired disambiguation: see also wrapped tokens (the usual form a bridged asset takes) and token migration (which replaces a host-chain token rather than mirroring it).

Node

A computer running a blockchain's software, holding a copy of the ledger and relaying transactions and blocks to its peers. Nodes are what make the ledger distributed: anyone can run one, verify the chain's history independently, and answer queries without trusting a third party. Block producers are nodes with an extra role, and explorers and APIs are services built on top of nodes. On TRON, a full node serves the latest still-reversible state, while solidified data reflects only finalized blocks.

O

OFAC / SDN list

OFAC — the US Treasury's Office of Foreign Assets Control — administers economic sanctions, and its Specially Designated Nationals and Blocked Persons (SDN) list names the sanctioned parties, including, since 2018, specific cryptocurrency addresses. US persons are broadly prohibited from transacting with listed parties, and centralized issuers act on the list: Tether adopted a voluntary policy in December 2023 of freezing USDT held at SDN-listed addresses, including on the secondary market. An SDN designation is an off-chain legal fact; its on-chain effect depends on what issuers and services choose or are compelled to do.

On-chain vs off-chain

The dividing line between data recorded on the blockchain itself — transactions, balances, contract state, all permanent and independently verifiable — and everything outside it, such as customer identities, exchange internal ledgers, and service databases. On-chain data can be read directly by anyone; off-chain facts must come from whoever holds the records, often via cooperation or legal process.

One-hop look-through

A bounded tracing step: when the immediate counterparty is a mechanical intermediary — a fresh pass-through address, a payment contract, a router — resolve one hop past it to find the economically meaningful party, and stop there. The discipline is the bound itself: looking through a single hop (asking who funded the funder) corrects for trivial indirection without the compounding error of walking a long chain, where every additional inferred hop multiplies the chance of a wrong turn. Also called proximate-funding analysis.

Operational hours

The time-of-day and day-of-week structure of an address's activity. A human operator in one timezone leaves a daily sleep gap and often a weekday rhythm; an automated service transacts around the clock with neither. A consistent activity window can hint at an operator's longitude band, and two addresses sharing the same distinctive schedule is soft evidence of a common hand — with the caveats that software can be scheduled to imitate a human pattern, and shift-worked operations blur it.

Origin candidate

An address or entity identified as a plausible creator or funder of a target address, ranked by the strength of the on-chain evidence tying it to the target's creation and early funding history. Treating origin as a set of ranked hypotheses, rather than a single asserted answer, keeps the conclusion proportionate to the evidence.

Origin vs control

The distinction between who set a wallet up — its creator and early funders, inferred from historical evidence — and who can sign for it today, which on chains like TRON can be read directly from current on-chain permission state. The two can diverge through a sale, a takeover, or a key compromise, so each question deserves its own answer. Not to be confused with control vs ownership, which separates a key-holding service from the customers whose funds it holds.

Owner permission

The highest permission on a TRON account: it can authorize any transaction type and — uniquely — rewrite the account's entire permission structure. By default it is held by the account's own address with a threshold of one, and whoever satisfies the owner permission ultimately controls the account.

P

Peg / de-peg

The fixed target value a stablecoin is designed to track — typically one US dollar. A de-peg is a sustained market deviation from that target, and it signals stress in whatever maintains the peg: doubts about reserves, a redemption bottleneck, or a failing algorithmic incentive loop.

Permission handoff

A dated on-chain event in which an account's permission keys or threshold are updated so that control passes from one key holder to another. Because the update is itself a recorded, timestamped transaction, a handoff gives an analyst definitive, datable evidence that an account changed hands — unlike a private-key handover, which leaves no on-chain trace at all.

Permission hijack

A hostile rewrite of a TRON account's on-chain permissions in which an attacker who has obtained the owner key submits a permission update inserting their own key and removing the legitimate holder's, seizing the account outright. Unlike a silent drain, the hijack leaves a dated, definitive record: the permission-update transaction itself marks the exact moment control changed hands.

Permission rotation

Any change to an account's permission state — keys replaced, added, or removed, or thresholds and weights altered. Rotation is a mechanism, not a motive: the same recorded act can be routine security hardening (retiring an old key), a sale (handing control to a buyer's keys), or a takeover (an attacker inserting theirs). What the ledger fixes is the fact and the date; which story it belongs to must be read from surrounding behavior — what the old and new keys each did before and after the change.

Person vs service

The classification question of whether an unlabeled address or cluster is operated by one individual moving their own funds or by a service moving many customers' funds. The answer changes what any flow means: a person's transfers reflect their own decisions, while a service's transfers commingle unrelated customers, capping what a single flow can attribute. Transaction volume, counterparty count, round-the-clock tempo, and sweep-like structure are the usual discriminators.

Pig butchering

A long-con investment fraud in which a scammer cultivates a victim over weeks or months — often through a feigned romance or friendship — then steers them into depositing ever-larger sums on a fraudulent trading platform, with cryptocurrency (frequently stablecoins) as the usual payment rail. The name refers to "fattening" the victim before the slaughter; the U.S. Treasury's FinCEN issued a dedicated alert on the typology in 2023. On-chain, victim deposits funnel through scammer-controlled deposit addresses into consolidation and cash-out infrastructure.

Poison rule (taint)

A strict taint-accounting convention under which any tainted input to a transaction marks all of its outputs as fully tainted, regardless of proportions. It guarantees no stolen value escapes tracking, at the cost of taint spreading rapidly to funds that are mostly clean — the opposite trade-off from the proportional haircut rule. Not to be confused with address poisoning, which is an attack on wallet users, not an accounting convention.

Proof-of-stake

A family of consensus designs in which the right to produce blocks is allocated by staked collateral rather than expended computation: participants lock the chain's asset, block production is apportioned by stake or by stake-weighted election, and misbehavior puts the stake or its rewards at risk. The security argument replaces proof-of-work's ongoing energy cost with capital exposure. TRON's delegated proof-of-stake is a variant in which holders' staked votes elect a small fixed set of block producers, rather than validators producing in proportion to their own stake.

Provenance

The documented origin and path of an asset — where value first appeared and every change of hands since. The word is borrowed from the art world, where an object's provenance is the ownership chain that authenticates it. On a public blockchain, provenance is unusually strong because every transfer is permanently recorded, so an asset's path across addresses can be reconstructed from the ledger itself — up to the points where the trail leaves it, such as a custodian's internal books or a cross-chain crossing.

Pseudo-multisig

A TRON permission configuration that displays multiple keys but does not actually require them together: the threshold is low enough, or one key's weight high enough, that a single key alone can authorize transactions. An account listing five keys above a threshold of one is operationally single-key. The pattern is a forensic tell — it can mark a takeover that quietly kept the victim's key in the list for appearances, or a shared-account arrangement — and it means a key count can never be read as security or joint control without checking weights against the threshold.

Pseudonymity

The property that blockchain addresses are public and persistent but carry no inherent link to a real-world identity. Everything an address does is permanently visible and attributable to the address itself; connecting the address to a person or organization takes additional evidence. Pseudonymous is not anonymous — a reused address accumulates history that analysis can eventually tie to an identity.

R

Redemption

Exchanging a token back with its issuer or custodian for the underlying it represents — a reserve-backed stablecoin for fiat, a wrapped asset for the locked original, a receipt token for the deposit behind it. Redemption is what anchors such a token's value: the claim is only as good as the issuer's ability and willingness to honor it. On-chain, redemptions often appear as transfers to an issuer-controlled address followed by burning — the mirror image of issuance.

Resource delegation

A TRON mechanism by which one account lends the Energy or Bandwidth derived from its own staked TRX to another account, without any TRX changing hands. Because it supplies a wallet's operating capacity rather than its funds, delegation marks an ongoing operational relationship — a fee-sponsorship link, not a funding-lineage link — and routine services such as exchanges do not delegate resources to customer wallets.

Return flow / round-tripping

A pattern in which value moves from a wallet back to an address that previously funded it, also called round-tripping. One-time counterparties rarely receive money back; bidirectional flow — especially rapid, repeated, or near-complete — indicates common control or an ongoing operator relationship between the two addresses.

S

Seed phrase

An ordered list of common words — typically 12 or 24 — encoding the master secret from which a wallet derives all of its private keys; also called a mnemonic or recovery phrase. Anyone who learns the phrase can regenerate every key and address it controls, so possessing the phrase is equivalent to possessing the keys.

Sibling wallet

Another address controlled by the same party as the one under examination — a second wallet of the same person or organization, kept for compartmentalization, day-to-day operations, or succession. Sibling relationships are rarely stated on-chain; they are inferred from converging evidence: a common funder, a shared permission key, coordinated timing, direct transfers between the pair, or one address inheriting the other's counterparties. Finding siblings widens the true scope of a subject's holdings and activity beyond any single address.

Sidechain

A separate blockchain with its own validators and block production, connected to a main chain by a bridge so assets can move between the two. A sidechain inherits none of the main chain's security — its guarantees are only as strong as its own validator set — and its ledger is separate, so activity there is invisible from the main chain except at the bridge. BitTorrent Chain (BTTC) is TRON's principal example; note the naming trap that BTT is a token while BTTC is the chain.

Signature

A cryptographic proof, produced with a private key over a transaction's exact contents, that the key holder authorized that transaction and no other. Nodes verify the signature before accepting the transaction, so a valid signature is definitive evidence the key was used — though not of who was holding it at the time.

Silent drain / key compromise

An account emptied by ordinary outbound transfers signed with its existing key, with no change to its permission set — the signature of a private-key compromise (or an insider using a retained key). Because nothing in account state changes, the only on-chain tell is behavioral: an abrupt, out-of-character sweep of the balance rather than any visible transfer of control.

Smart contract

A program deployed to a blockchain that runs deterministically when called, holding its own state and balance and enforcing its rules without any operator's ongoing involvement. Because a contract executes code rather than acting on anyone's initiative, its address represents logic — funds can flow through it, but the contract itself is not a person or a controlling entity.

Stablecoin

A token designed to hold a steady value against a reference asset, most commonly one US dollar. The target is maintained either by an issuer holding reserves that back and redeem the token, or algorithmically through mint-and-burn incentives — two very different risk models behind the same face value.

Stablecoin freeze / blacklist

An issuer power built into a stablecoin's contract that flags an address so its balance can no longer be moved. In Tether's USDT contract the flag is set by an addBlackList function, and a companion destroyBlackFunds function can then permanently erase the frozen balance and shrink total supply. A freeze is an administrative act by the issuer — not to be confused with a seizure, which is a legal transfer of ownership under court or state authority.

Stake 1.0

TRON's original staking model, executed with the FreezeBalance transaction type, in which staking and resource delegation were bound together in a single operation: redirecting a delegation meant unstaking and re-staking, stakes carried a three-day lock, and unstaking cancelled all of the account's Super Representative votes at once. Not to be confused with Stake 2.0, the decoupled model that superseded it in 2023 — though resources and votes from old Stake 1.0 positions remain valid.

Stake 2.0

TRON's current staking model, live on mainnet since 7 April 2023, executed with the FreezeBalanceV2 transaction type. It decouples staking from delegation — stake once, then delegate or re-delegate unused Energy and Bandwidth freely — and replaces the old lock with an unstaking window: withdrawn TRX only becomes spendable after a waiting period (14 days at launch), with votes revoked proportionally rather than all at once. Not to be confused with Stake 1.0, the earlier coupled model.

Staking (freeze)

Locking TRX (historically called freezing) to obtain network resources instead of paying fees per transaction — a stake earns either Energy or Bandwidth, chosen at stake time. Staking also grants TRON Power for Super Representative voting, at one vote per staked TRX, making a wallet's stake both its fee budget and its governance weight.

sun (unit)

The smallest denomination of TRX: 1 TRX = 1,000,000 sun. On-chain TRX amounts are recorded as integer sun values, so raw figures must be divided by one million to read as TRX. Not to be confused with the SUN governance token or with Justin Sun, the TRON founder the unit is named after.

T

Taint / taint propagation

An accounting approach that marks value as tainted when it traces back to a known illicit source — theft, scam, or sanctioned entity — and defines how that mark spreads through subsequent transactions. Because most ledgers merge funds, propagation needs an explicit rule: treat everything a tainted input touches as tainted (poison), pass on only the proportional fraction (haircut), or follow an ordering convention such as first-in-first-out. Not to be confused with address poisoning, an attack on wallet users; the taint "poison rule" is an accounting convention.

Ticker / symbol

The short label a token displays — "USDT", "TRX", "BTT" — chosen by whoever deploys the token contract, with no registry enforcing uniqueness or truth. Any deployer can launch a contract whose name and symbol copy a well-known token's exactly. Authenticity therefore never rests on the label: the contract address is a token's only real identity, and a token should be treated as whatever its contract address says it is, not whatever its symbol claims.

Token

A unit of value recorded inside a smart contract rather than in the chain's native ledger — the contract keeps the balance table, and moving tokens means asking the contract to update it. Not to be confused with a coin, which is the chain's built-in asset (TRX on TRON) used to pay for the network itself.

See also: Coin vs token , Smart contract , TRC-20

Token decimals

A token contract's declared count of fractional digits. Balances and transfer amounts live on-chain as whole integers of the smallest unit; the decimals value tells software where to place the point for display. TRC-20 USDT uses 6 decimals, so an on-chain amount of 1,000,000 is one USDT — and TRX itself follows the same scheme natively, carried as an integer number of sun (1 TRX = 1,000,000 sun). Reading raw amounts without scaling misstates values by factors of a million or more.

See also: sun (unit) , USDT (Tether) , TRC-20 , Token

Token migration / swap

The conversion of a project's tokens from a host chain to its own newly launched native chain, credited one-for-one, after which the original host-chain tokens are retired. TRON performed this in June 2018: ERC-20 TRX on Ethereum was swapped 1:1 for native TRX, largely via participating exchanges, with the independent mainnet's genesis block on 25 June 2018 — which is why no native TRON history exists before that date. Not to be confused with bridging: a migration replaces the old token, whereas a bridged asset is a stand-in backed by the original locked elsewhere.

Transaction

A signed instruction ("tx" for short) that changes on-chain state — transferring value, calling a contract, or updating an account's settings. Once it is included in a block and that block reaches finality the record is permanent: later transactions can supersede its effects, but the entry itself can never be edited or deleted. Before finality, a freshly included transaction can still be reversed if its block is reorganized out.

See also: Signature , Block , Transaction ID (txID)

Transaction ID (txID)

The hash that uniquely identifies a transaction — the value explorers and APIs accept for lookup, also called the tx hash. On TRON the txID is the hash of the transaction's raw unsigned data, so it is fixed the moment the transaction is constructed, before any signature is applied. A txID is the standard way to cite a specific on-chain event: it names exactly one immutable record that anyone can independently retrieve and verify.

See also: Hash , Transaction , Block explorer

Transfer event

The standard log a token contract emits whenever tokens move, recording the sender, recipient, and amount. Because event logs are written permanently to the chain, Transfer events are the durable record of token movement — explorers and analysts reconstruct a token's entire flow history from them. The standard also permits zero-amount Transfer events, which still plant the sender's address in a wallet's visible history.

See also: Event log , TRC-20 , Zero-value transfer

TRC-10

TRON's older token standard, implemented directly at the protocol level with no smart contract — issuing one requires only a fee, not deployed code. TRC-10 transfers are native transactions, so they consume Bandwidth rather than Energy and can activate a new account the same way a TRX transfer does.

See also: Bandwidth , TRC-20 , Account activation

TRC-20

TRON's smart-contract standard for fungible tokens, derived from Ethereum's ERC-20: a compliant contract exposes transfer, approve, allowance, and transferFrom, and emits Transfer and Approval events. USDT on TRON is issued as a TRC-20 token. Because every TRC-20 transfer is a contract call, it consumes Energy (plus Bandwidth) and — unlike a TRX or TRC-10 transfer — cannot activate a not-yet-created account.

TriggerSmartContract

TRON's contract-call transaction type (ContractType 31): every invocation of a deployed smart contract, including every TRC-20 token transfer, travels as a TriggerSmartContract naming the caller, the contract, and an encoded call-data payload. Two forensic consequences follow. The transaction's visible destination is the contract, not the payee — a token transfer's real recipient and amount sit inside the call data and the resulting Transfer event. And a TriggerSmartContract cannot activate a new account, so an address that has only ever received TRC-20 tokens holds balances in contract storage while remaining unactivated at the protocol level.

TRON Power

TRON's voting weight: staking TRX grants TRON Power at one unit per TRX staked, spendable as votes for Super Representative candidates. It is non-transferable — it cannot be sent or sold, only earned by staking — and unstaking revokes it along with the votes it was backing. TRON Power is how holdings translate into governance influence under delegated proof-of-stake: block-producer elections are decided by staked, revocable votes rather than by one account, one vote.

TRON Virtual Machine (TVM)

TRON's runtime for smart contracts, largely compatible with the Ethereum Virtual Machine, so Solidity contracts and EVM tooling port to TRON with little change. The key operational difference is metering: instead of Ethereum's auctioned gas, the TVM charges execution in Energy, a TRON resource obtained by staking TRX or paid for by burning it.

TRX

The native coin of the TRON network. TRX settles value directly (no contract call needed), is staked to obtain Energy, Bandwidth, and voting power, and is burned to pay fees when staked resources fall short. Its smallest unit is the sun: 1 TRX = 1,000,000 sun.

See also: sun (unit) , Staking (freeze) , Energy , Bandwidth

U

USDT (Tether)

A US-dollar stablecoin issued by Tether, first launched in 2014 on Bitcoin's Omni Layer and circulating on TRON as a TRC-20 token since April 2019. Tether retains privileged functions in the token contract — it can blacklist addresses and destroy blacklisted balances — so every USDT balance is ultimately conditional on the issuer's authority. Not to be confused with counterfeit tokens that copy the USDT name and symbol without any issuer or backing.

UTXO

Unspent Transaction Output — the ledger design used by Bitcoin, in which value exists as discrete spendable outputs rather than account balances. Each transaction consumes specific prior outputs and creates new ones, so every unit of value carries a verifiable chain of ancestry back through the transactions that produced it (hence the alias "coin lineage"). Not to be confused with the account model, where balances are mutable numbers and per-coin ancestry does not exist.

W

Wallet

Software or hardware that stores private keys and uses them to sign transactions. A wallet holds keys, not coins — balances live on the ledger itself — so the same funds can be reached from any wallet loaded with the same keys, and losing the wallet loses nothing if the keys are backed up elsewhere.

Wallet drainer

A phishing toolkit that tricks a victim into signing a transaction — most often a token approval — that grants the attacker's contract or address the right to move the victim's funds, which the operator then pulls out in one or more sweeps (the "approval drain" pattern). The victim's own key signs the enabling transaction, so on-chain the theft begins with an authorization the account itself granted.

Wallet sale / handoff

A transfer of an account from one party to another by agreement — either a visible on-chain permission rewrite that installs the buyer's keys, or an off-chain handover of the private key or seed phrase, which leaves no on-chain marker at all. A retained-key sale is the hazard case: the seller keeps a copy of the key, so the buyer never gains exclusive control.

Wrapped token / asset

A token that stands in for an asset held elsewhere — the original is locked with a custodian or contract, and a redeemable claim on it is issued where it is needed, such as WTRX (a TRC-20 wrapper around native TRX that lets TRX trade in contract-only venues). Not to be confused with native issuance: a wrapped or bridged token is only as good as the locked backing behind it.

Z

Zero-value transfer

A token transfer of zero units that still executes successfully and emits a standard Transfer event, permanently recording the sender in the recipient's token history even though no value moved. A variant known as a spoofed transfer abuses transferFrom with a zero amount to fabricate an event that appears to come *from* the victim's own address. Both are staple tools of address poisoning, planting a look-alike counterparty in a wallet's history.