Every USDT TRC20 transfer you make costs TRON Energy — whether you hold it, rent it, or let the network burn TRX. Here is what it costs right now:
Computed by our USDTGuides Energy Calculator from TronScan, CoinGecko and manually verified marketplace prices (verified 2026-08-07). See how we calculate →
📄The Attack in Action
Attackers monitor public chains for active wallets. They send $0–$1 of USDT (or a worthless token) to your address from an address crafted to look like one of your frequent contacts — same first 4 and last 4 characters. Your wallet history now shows “You sent X to Tron...abc4” and a poisoned entry next to it.
Days later, you open history to copy that contact’s address. Your wallet shows two similar-looking entries. If you pick the wrong one, your USDT goes to the attacker. They did not hack anything — they bet on human copy-paste.
The scale is industrial: bots scan TRON for active addresses and poison thousands of wallets daily. If you have ever sent or received USDT, you have likely already been poisoned once.
📄Why It Works
Wallets display short previews (first/last characters), and humans trust visual patterns. A 34-character address with matching edges looks “right.” The middle is where the poison lives.
| Address | Edges | Verdict |
|---|---|---|
| TXyz...abc4 (your real contact) | TXyz / abc4 | Correct |
| TXyz...X7q9...abc4 (poisoned) | TXyz / abc4 | Fake — middle differs |
| TXyz...Qm3n...abc4 (poisoned #2) | TXyz / abc4 | Fake — middle differs |
📄The Defense
- Never copy addresses from transaction history.
- Save frequent contacts and copy from the saved list.
- Verify the full address before confirming — not just edges.
- Mark unexpected dust transactions as spam/hide them.
- Use wallets with contact book features.
Our iron rule: the last step of every transfer is reading the full destination address out loud against your saved contact. Two seconds, zero poison.
Wallets are adding anti-poisoning warnings (e.g., “this address has never transacted with you before”). Treat those warnings as serious — they exist because this attack is common.
📄If You See Poisoned Dust
You can’t remove the history entry, but you can hide the token in your wallet, ignore the transaction, and continue using your saved contacts. The attacker gains nothing unless you copy their address.