How we hardened TronTransfer: the November 2026 security update

By TronTransfer team · November 5, 2026 · 5 min read

Short answer: we ran an internal security review of the TronTransfer app and server and shipped the fixes in three rounds between October 29 and November 5, 2026. The page where you sign now runs only code served from our own domain and pinned by a hash, scam-check results can't inject anything into the page, business deposit wallets have to prove ownership with a signature, and the libraries with known security advisories are updated. It was not an external audit, and TronTransfer stays non-custodial: your keys never leave your wallet.

TronTransfer never holds your USDT or your keys: you sign every transaction in your own wallet. That makes the page where you sign, and the server that broadcasts what you signed, the two places worth defending. Over the last week we reviewed both line by line and fixed what we found. Here is what changed, written so you can check the parts that matter to you.

What we protect, and why

A non-custodial app can't lose funds it never holds, so the realistic risks are different from an exchange’s. Three matter most:

• The signing page. If someone could change the code that runs while you sign, they could try to show you one recipient and ask your wallet to sign another. Your wallet still shows the real transaction before you approve, but we don’t want the page itself to be the weak link.
• The server. It checks your two signed transactions, rents the energy and broadcasts your USDT transfer. It should never be tricked into paying for more than you paid, or into crediting a payment twice.
• Business accounts. Prepaid API accounts hold a TRX balance for fees, so deposits must reach the right account.

The signing page runs only our own pinned code

The app needs three libraries in your browser: TronWeb (to build the transactions your wallet signs), a small Buffer helper, and a QR-code generator. Before the update they loaded from public code CDNs. Now:

• All three are served from app.trontransfer.com/vendor/, our own domain, with the version in the file name.
• Each script tag carries a Subresource Integrity (SRI) hash. Your browser computes the file’s SHA-384 fingerprint and refuses to run it if it doesn’t match.
• TronWeb is byte-for-byte the published [email protected] build from npm, so anyone can compare it.
• The QR code for your address is now drawn in your browser. Before, a third-party QR service received the address to draw it.
• The app sends a Content Security Policy in report mode: browsers tell us if anything tries to load from somewhere it shouldn’t. Once a week of reports is clean we will switch it to blocking mode.

Scam-check results can’t inject anything

Before you send, the app shows the recipient check and, for larger amounts, an AML screening result from an outside provider. Text and numbers that come from outside are now escaped and type-checked before they are shown, and transaction IDs must look like real 64-character IDs before they become links. A bad or compromised answer from a provider can only ever show up as plain text.

The server: payments count once, energy has a ceiling

• Each payment is claimed once. A fee or AML-check payment transaction is recorded the moment it is used, so the same transaction can’t pay for a second transfer or a second report.
• Energy has a ceiling. The energy we rent for a transfer is sized from the network’s own estimate. It is now capped just above what a transfer to a brand-new address needs, so a wrong estimate can’t make us rent far more than the transfer uses. Every past transfer was under the cap.
• Lookups are rate-limited per visitor. The recipient check and the receipt lookup share our network quota with real transfers, so each visitor gets a generous per-minute allowance and nobody can use them up for everyone else.
• Request sizes are capped, operator pages refuse cross-site requests, and browsers are told to use HTTPS only.

Business accounts: deposit wallets must sign

Prepaid business accounts top up by sending TRX with a memo code. A customer can also confirm a wallet so deposits from it count without the memo. Before, any wallet that had sent one memo deposit could be confirmed. That is risky when the wallet is an exchange’s shared withdrawal wallet: other people’s deposits from that exchange could have been credited to one account. Now the wallet itself must sign a short message naming the account (“TronTransfer: wallet T… deposits to account TT-…”). An exchange’s shared wallet can’t sign it, so it can’t be confirmed. The deposit checker was also changed so a flood of tiny transfers can’t hold up real deposits.

Patched libraries

Two server libraries used by TronWeb (axios and follow-redirects) had published high-severity advisories. Both are updated, and the dependency scan now reports no high-severity issues. We chose a version that had been out for two months rather than one released days earlier, because brand-new releases are where supply-chain attacks tend to land.

Check it yourself

• Pinned scripts: open app.trontransfer.com, view the page source, and look at the <script> tags: each points to /vendor/… and has an integrity="sha384-…" attribute.
• Same TronWeb as npm: run curl -s https://cdn.jsdelivr.net/npm/[email protected]/dist/TronWeb.js | openssl dgst -sha384 -binary | openssl base64 -A and compare the result with the integrity value of the TronWeb tag.
• Your transfer: after a send, look up your wallet on any TRON explorer. You will see your fee going to our public fee address and your USDT going straight to your recipient, with 0 TRX burned for energy. Here is the full checklist.
• Security contact: trontransfer.com/.well-known/security.txt.

What didn’t change

TronTransfer is still non-custodial: you sign in your own wallet and your keys never reach us. The order of operations is the same: your fee must be in a block before we rent the energy, and your USDT transfer is broadcast only after the energy is on your address. And the honest limit is the same too: this was an internal review, not an external audit. If you find something we missed, please tell us.