TRON account permission (multisig) scams explained: the “free USDT seed phrase” trap

By TronTransfer team · October 22, 2026 · updated October 24, 2026 · 7 min read

Short answer: a public seed phrase for a wallet full of USDT is bait. The scammer has already moved the account's owner permission to their own address, so the phrase can't move the USDT, and any TRX you send to pay the fee is swept straight to them. Never send TRX to an account whose seed phrase you were given.

Someone posts a seed phrase in a Telegram group or a YouTube comment. You import it out of curiosity and find a wallet holding thousands of USDT and an empty TRX balance, so it can’t pay to move it. Send a few TRX for the fee and they disappear within seconds. That isn’t bad luck. It’s a trap built on a TRON feature called account permissions, and the same feature is used to take over real wallets. Here’s how it works and how to check any account in a minute.

What account permissions are

On most blockchains, one private key controls one account. TRON goes further: each account has a permission structure that can spread control across several keys (TRON docs: multi-signature).

• The owner permission has full control, including the power to change every permission on the account.
• Active permissions can be limited to certain operations, such as transfers.
• Each permission has a threshold and a list of keys with weights. A transaction is valid only when the signatures’ combined weight reaches the threshold.

Permissions are changed with an AccountPermissionUpdateContract transaction, signed under the owner permission. It replaces the whole permission set, owner included, and costs 100 TRX. An account can have up to 8 active permissions. This is a legitimate, useful feature: an exchange or a company treasury can require two of three directors to sign every payment. The problem is that the same transaction can hand your account to a stranger, and many people have never heard of it.

How the “free USDT seed phrase” trap works

1. Set-up. The scammer creates a wallet, deposits some USDT, and changes the owner permission (and usually the active permission) so that their address is in charge. The original seed phrase still opens the wallet in an app, but it no longer has the authority to move funds out.
2. The “leak”. The phrase is posted somewhere it looks like an accident: a group chat, a comment, a screenshot, a “help, how do I withdraw from this wallet?” message.
3. The hook. You import it and see a real USDT balance on-chain. To move USDT you need TRX for energy, and the wallet has none.
4. The sweep. You send TRX in. The scammer, who controls the account, moves it out straight away, often with an automated script. Your attempt to send the USDT fails because your key isn’t enough to sign for the account.

The USDT was never available. The bait is the balance; the catch is your TRX. Security teams and researchers have described this pattern repeatedly (TronSec explainer, Gate, CoinsDo).

The bigger version: taking over a real wallet

The same transaction is used against people’s own wallets. There are two common routes:

• A disguised signature. A phishing site or fake dApp, often an “airdrop claim”, a “wallet verification” or a fake support page, asks you to sign something. It is really an AccountPermissionUpdateContract that puts the attacker’s address in your owner permission.
• A stolen key. If your phrase or key leaks through a fake extension, a phishing form or malware, the attacker can change the permissions themselves and lock you out, instead of emptying the account immediately.

Victims then often receive a second offer: pay a fee and someone will “remove the multisig restriction”. imToken’s security team documents this follow-up scam in detail (imToken Security Monthly Report #36). Only the keys in the owner permission can change it, so nobody else can “remove” anything.

How to check any TRON account in one minute

1. Open tronscan.org and search for the address.
2. On the account page, open the permissions section (on some layouts it sits under “More”).
3. Look at the owner permission: it should list exactly one key, your own address, with a weight that meets the threshold (usually 1 of 1).
4. Do the same for each active permission.
5. If any other address appears, or your key’s weight is below the threshold, someone else controls this account. Don’t send TRX, USDT or anything else to it.

Do this check before you rely on any wallet you didn’t create yourself, and once in a while for your own.

Wallets are catching up, so keep yours updated. TronLink says its TRONSCAN-based security service checks multisig permission changes (TronLink help), and imToken added an account permission check when you import a TRON wallet in v2.14.0 (imToken release notes).

If it already happened to you

• Stop sending funds to the account. Anything that arrives can be taken.
• Make a new wallet with a new seed phrase, ideally on a device you trust, and give payers the new address.
• Revoke what you can. If you still control other wallets that used the same phrase or the same sites, check their approvals too (how to check and revoke USDT approvals).
• Report it to the platform where you were contacted, and to the police if the amount matters. Keep transaction IDs.
• Ignore anyone offering recovery for a fee or asking for your phrase. That’s the second round of the same scam.

How TronTransfer Wallet handles permissions

TronTransfer Wallet is in development and early access, not yet released or audited. These protections are part of its first release:

• Permission guard. Websites can’t ask the wallet to sign a permission change at all by default. Inside the wallet, a permission change is a full-screen red warning that requires typing a confirmation phrase, so it can’t happen by accident.
• Honeypot check on import. After you import a phrase or key, the wallet reads the account’s permissions. If your key doesn’t fully control the account, it tells you (“This wallet is controlled by someone else, anything you send to it can be taken”) and won’t let you send TRX into it.
• Change alerts. The wallet re-checks your own accounts’ permissions and warns you if they change.

It’s one of eleven defences we cover in the 11 ways TRON wallets get drained.

Why the TronTransfer relay can’t do this to you

When you send USDT through app.trontransfer.com, you sign exactly two transactions: a plain TRX fee to our public fee address, and a normal USDT transfer() to your recipient. We never request an approval or a permission change, and we never ask for your seed phrase. A signed TRON transaction can only do what it says, so there’s nothing in it that could hand your account to us or anyone else. That’s how 2,059 transfers have run since July 2026; you can check each one on Tronscan.

Sources

• TRON developer docs, multi-signature and account permissions: developers.tron.network/docs/multi-signature
• imToken: “Remove Multisig Restriction” scam (report #36)
• CoinsDo: TRX/TRC-20 multisig scam alert
• TronSec: found a seed phrase with free USDT?
• Gate: identifying multisig traps