How TRON permissions work
A TRON account has an owner permission and active permissions. Each lists the keys that can sign and how many signatures are needed. By default your own key controls everything. Anyone with your key can change the owner permission to their own key, or to a multisig setup where their key is required. After that, your key alone cannot move funds.
How people get caught
| Route | What happens |
|---|---|
| A fake wallet app or phishing page | Your seed or key is captured; the attacker changes permissions |
| A “free” wallet with USDT in it | The scammer shares a seed; the wallet is multisig-locked; you deposit TRX for fees and they take it |
| A P2P buyer or “partner” who sets up your wallet | They keep a permission for themselves |
| A “multi-signature for security” tutorial | You add their key as an owner |
The second route is the shared seed phrase trap: the shared seed phrase scam.
How to check your TRON account
- Open tronscan.org and search your address.
- Open the permissions section of the account page.
- Check the owner permission lists only your address, with a threshold of 1.
- Check active permissions do not include keys you do not know.
If your account is already changed
You cannot undo it with your key alone. Stop sending funds or TRX to that address, warn anyone who pays you, and create a new wallet on a clean device with a new seed. Report the attacker’s address to the platforms you use and to your cybercrime unit. Anyone offering to “release” the account for a fee is a second scammer. Recovery scams.
Related
What USDT TRC20 is, TronLink scams, flash USDT TRC20.
How an account is taken over, step by step
-
01 Key exposed
- How
- fake wallet app, phishing page, shared seed
- Owner
- still you
-
02 Permission update
- Owner key
- changed to attacker
- Threshold
- 1
-
03 Your view
- Balance
- visible
- Receive
- works
Nothing looks wrong.
-
04 You try to send
- Result
- signature not enough
- Incoming funds
- swept by attacker
Why attackers leave the balance in place
An attacker who controls your account could empty it at once. Many wait. As long as you believe the wallet is fine, you keep sending funds to it, and people keep paying you there. The attacker sweeps incoming USDT and TRX as it arrives, or waits for a large deposit. Some victims only notice when a payment they make fails.
Reading the permissions on Tronscan
| Field | Healthy account |
|---|---|
| Owner permission keys | Only your own address |
| Owner threshold | 1, with your key weighted 1 |
| Active permission keys | Only your own address |
| Recent “account permission update” transactions | None you did not make |
If any of these show an address you do not know, treat the account as lost and move to a new wallet with a new seed phrase.
Legitimate multisig
Multi-signature setups are a real security feature: businesses use them so that several people must approve a payment. The scam abuses the same mechanism. If you want multisig for safety, set it up yourself with keys you control, on hardware you own, following TRON’s official documentation, and never with help from a stranger.
TRON account permission scam: the signs in your wallet
A TRON account permission scam changes who controls your account without moving your funds at first. That is why many victims do not notice until they try to send.
| What you see | What it may mean |
|---|---|
| Sending fails with a permission or signature error | Your key no longer has enough weight to sign |
| Balance still shows, but nothing can move | The owner or active permission points to another address |
| A transaction in history called a permission update | Someone changed the account’s control settings |
| A seller sent you a wallet “with USDT already inside” | The wallet is controlled by them through multisig |
Check the Permissions section of your address on Tronscan. If any key there is not yours, the account is not fully yours.
USDT multisig wallet scam: the “wallet with funds” offer
A USDT multisig wallet scam often starts with a stranger sharing a recovery phrase for a wallet that holds a large USDT balance. They claim they cannot withdraw it and offer you a share if you help.
- You import the phrase and see the balance.
- You try to send USDT, but you need TRX for fees.
- You send your own TRX to the wallet.
- The transfer still fails, because the wallet’s permissions require another key.
- Your TRX is swept out by the real controller.
The balance was bait. The wallet was set up so that anyone can see it but only the scammer can move it. Never send funds into a wallet a stranger gave you.
How to protect your TRON account from permission changes
- Never sign transactions from sites you reached through a link in a token, a chat or an ad.
- Read every TronLink or Trust Wallet signing request. A permission update is not a normal step.
- Do not import recovery phrases shared by strangers into a wallet that holds your own funds.
- Check your account’s Permissions page on Tronscan every few months.
Wallet specific advice is in TronLink scams and Trust Wallet scams.
If your TRON permissions were changed
- Stop sending TRX or USDT into the account.
- Create a new wallet with a new phrase on a clean device.
- If any part of the account still accepts your signature, move funds out at once.
- Note the address that now controls the account and the hash of the permission change.
- Report it to the police and follow our recovery steps.
USDT held at a controlled address may still be frozen if police contact Tether quickly. See how Tether freezes USDT.
Questions about TRON multisig scams
Is multisig itself a scam?
No. Multisig is a real security feature used by businesses and careful holders. Scammers misuse it to lock victims out.
Can TRON support undo a permission change?
No. Only the keys named in the current permissions can change them again.
Questions people ask
What is the TRON multisig scam?
A scam where a TRON account’s permissions are changed so the scammer must sign every send.
Why can I receive but not send USDT on TRON?
Your account permissions may have been changed. Check them on Tronscan.
Can a multisig change be reversed?
Not without the key that now controls the owner permission.
How do I avoid it?
Never share your seed or key, install wallets only from official sources, and never use a wallet someone else set up.
Sources
Not sure about an offer?
Send it to us before you pay. A person reads it. It costs nothing.
Ask us about it