The TRON Multisig Scam: When Someone Takes Control of Your Wallet

The message appears in a crypto Telegram group, or as a "mistaken" comment under a YouTube video:

"Pls help, how do I move USDT to Binance? My phrase: apple river window stone…"

Someone has supposedly pasted their twelve-word seed phrase in public. You import it into a wallet out of curiosity and, sure enough, there's 4,800 USDT sitting there. To move it, you need TRX for the network fee. You send ₦20,000 worth of TRX. The transfer still fails. And your TRX is gone.

Welcome to the TRON multisig scam.

What "multisig" means on TRON

On TRON, a wallet's owner can decide who is allowed to approve transactions. These are called permissions:

• the owner permission has full control, including changing the permissions themselves;
• the active permission can be set up to approve normal transactions.

You can make a wallet require one key, or several keys together (multi-signature, or "multisig"). Businesses use this for good reasons. Scammers use it to build traps.

Scam 1: the "leaked" wallet full of USDT

1. The scammer creates a wallet and puts USDT in it.
2. They change its permissions so that only their own separate key can approve transactions.
3. They post the seed phrase publicly, pretending it was a mistake.
4. You import the phrase. You can see the USDT, but your copy of the key no longer has the right to move it.
5. You assume the problem is the fee, so you send TRX. The scammer's key then moves your TRX out.

The USDT was never available to you. The bait was the balance; the catch was your TRX.

Scam 2: taking over your own wallet

The more dangerous version targets your real wallet. Scammers try to get you to sign a transaction that adds their address to your wallet's owner permission. They might:

• send a link to a "USDT reward" or "free energy" site that asks you to connect and approve;
• ask you to "verify your wallet" for a job, an airdrop or a recovery service;
• trick you into revealing your seed phrase, then change permissions themselves.

Once they hold owner permission, they can move everything, and change the permissions so you can't take them back. Some even leave your balance for a while, so you keep sending more to an address they already control.

How to check your wallet's permissions

1. Go to tronscan.org and type it yourself.
2. Search for your wallet address.
3. Open the account's permissions section.
4. Check that the owner and active permissions only contain addresses you recognise, normally just your own.

If you see an address you don't know, treat the wallet as compromised.

If it's already happened

• Stop sending anything to that address. It isn't yours any more.
• Create a brand-new wallet with a new seed phrase, on a device you trust.
• If you approved token access as well, read how to revoke token approvals.
• Ignore "recovery agents", however official they look. Our post on crypto recovery scams explains why paying them only adds to the loss.

Rules that keep you safe

• Never import a wallet someone else gives you. A shared seed phrase is always bait.
• Never share your own seed phrase, with anyone. Our explainer on seed phrases covers why.
• Don't connect your wallet to sites from DMs, comments or ads.
• Read what you're signing. If a wallet pop-up mentions "permission", "owner" or "account update", stop.
• Keep fee coins small. Hold only the TRX you need for fees; see TRON energy and bandwidth for how fees work.

Where KWIQ fits in

This scam targets self-custody wallets where you hold the seed phrase. Your KWIQ deposit address isn't something you import into another wallet, and moving money out of your KWIQ account needs your transaction PIN. Keep that PIN, your password and any one-time codes to yourself, and nobody can use this trick against your KWIQ balance.

When USDT lands in your KWIQ wallet, you can sell it for naira with zero conversion fees. Download the KWIQ app, or create an account on the web.