A stranger’s recovery phrase with USDT: the permissions trap

What the bait looks like

Under a crypto video, in a chat or in private messages someone asks a naive question: “I have a wallet, here is the recovery phrase, there are 8,000 USDT, how do I move them to an exchange?” Sometimes the phrase is “accidentally” shown on screen or sent to you “by mistake”.

You import the phrase and see a real balance of real USDT. To move it you need TRX for the fee, and the wallet has none. You send a little TRX there — and it either vanishes instantly, or it stays but the USDT transfer still fails.

Why you cannot withdraw

On TRON every account has permissions: who can control the account and which actions each key is allowed. There is the owner permission and the active permissions. Each permission has a list of keys with weights and a threshold: how much weight is needed for an operation to go through.

The scammer reconfigured the permissions in advance: the key from the posted phrase can no longer sign transfers, or its weight falls short of the threshold. Only the scammer’s key signs. The phrase lets you “look” at the wallet, nothing more.

The TRX you sent for the fee is taken by the scammer’s program that watches the wallet. The scheme earns a little from hundreds of such “helpers”.

The same mechanism against real owners

Permissions can also be changed on your wallet if someone gets your key: through a fake site, a fake wallet app or a file you downloaded. The scammer adds their key as owner and removes yours. The balance is still visible in your wallet, but every transfer is rejected. Sometimes you then get a message demanding a ransom for “unlocking”.

Signs: a transfer fails with an error about signatures or permissions, and in a blockchain explorer the account shows unfamiliar keys or a threshold above one.

How to check a wallet’s permissions

• Paste the address into GuardPay /check: the check shows whether the account’s permissions were changed and how many keys are needed to sign.
• If USDT will not send, the “USDT won’t withdraw” diagnosis checks permissions, freeze and energy separately and tells you whether topping up TRX will help.
• In a blockchain explorer, open the account’s permissions section and compare the keys with your own address.

What to do

If you found a “stranger’s” phrase, send nothing to that wallet. If the permissions were changed on your wallet, the key is already compromised: stop incoming payments to that address, create a new wallet with a new phrase on a clean device and give the new address to those who pay you. Whatever already sits on the captured address cannot be moved without the scammer’s key, so offers to “unlock it for a fee” are the next round of the same scheme.