TRX (TRON) multisig scams have continued to affect wallet users recently. Scammers lure users into downloading fake wallet apps to get their mnemonic phrases / private keys. Instead of stealing the tokens right away, they first change the permissions of the user's TRX account.
Once the permissions are changed, the wallet address can still receive tokens as usual, but the user can no longer transfer tokens out. Scammers then wait for the user to keep transferring more tokens into the address before stealing them.
This article explains how TRON multisig works, common tactics used by scammers, and how to protect yourself and check whether your account permissions have been compromised.
1. What is the TRON multisig mechanism?
Multisig is a security mechanism on the TRON network. It allows one account to be managed by multiple addresses, each with a different weight. A transaction can only be executed when the total weight of the signing addresses reaches the required threshold.
For example, when a TRX wallet is created, the account’s own address has owner permission by default, with both its weight and threshold set to 1. This means a transfer can be initiated only after it is signed and authorized by the address holding the owner permission.
If you use the multisig mechanism to add your other addresses to the account permission, set each address’s weight to 1, and set the threshold to 2, then at least two addresses, or 2/N, must sign together for a transaction to be completed. This provides an extra layer of confirmation.
Multisig is often used to improve personal account security or enable multiple people to manage the same account. However, when scammers exploit this mechanism to change a user's wallet account permissions, the user effectively loses control over the account and its assets.
Account with normal permissions👆
Note: Owner permission is the highest permission of a TRX account. An address with this permission can perform all operations in the account. Learn more: What is TRON multisig?
2. What are TRON multisig scams?
In this type of scam, scammers usually use the stolen mnemonic phrase / private key to restore the wallet in another wallet app that supports multisig. They then sign an account permission update transaction to add their own address to the permissions, or replace the original permission with their address as the only authorized one.
Because transfers now require either both the user's and the scammer's signatures, or only the scammer's signature, this type of fraud is commonly known as a TRX multisig scam.
This means that after the permissions of a user’s TRX account are changed, any transaction initiated by the user must be signed and authorized by the scammer before it can be completed. If the user initiates a transaction alone, they may see an error such as “server: SIGERROR”.
Account with changed permissions 👆
You may wonder why you still cannot transfer tokens out “on your own” even though you have the mnemonic phrase / private key of your account.
The reason is that a mnemonic phrase / private key is used to generate a signature, but whether that signature is valid ultimately depends on the account’s current onchain permission rules.
For example, you can think of account permissions as a set of access rules recorded onchain. Under normal circumstances, only your key can open the door. When scammers steal your mnemonic phrase / private key, it is like they have copied your key. They then change the access rules to “both your key and the scammer’s key must be used together”, or “only the scammer’s key can be used”.
In this case, you only have your own key and cannot meet the new access rules on your own, so you cannot independently transfer assets or change the account permissions again. Scammers, however, have both a copy of your key and their own key, so they can meet the rules and transfer tokens away at any time.
If users continue receiving tokens without attempting an outgoing transfer, they may remain unaware of the compromised permissions for a long time.. Scammers exploit this delay, waiting until enough tokens accumulate in the account before stealing them all at once.
3. How else do scammers use multisig for fraud?
In addition to luring users into downloading fake wallet apps, scammers may also carry out multisig scams in the following ways:
Unsafe backups: Users may accidentally expose their mnemonic phrases / private keys by taking screenshots, photos, or saving them in phone albums, notes, WeChat Favorites, computers, or other internet-connected devices. These backups may be stolen through cloud sync, malware, or account breaches.
Tricking users into signing malicious transactions: Scammers may promote fake accounts, energy purchase websites, or other malicious DApps, or lure users into scanning unknown QR codes. If users enter their password and sign without understanding the transaction details, they may actually be approving an account permission update transaction.
Publishing mnemonic phrases / private keys as bait: Scammers may publicly post the mnemonic phrase / private key of a bait wallet on Telegram, X, and other social platforms, claiming that there are tokens in the wallet that can be transferred out. When users import the wallet and send TRX to the address to pay for network fees, they find that the permissions have already been changed. As a result, they can neither transfer out the existing tokens nor recover the TRX they transferred.
Fake recovery services and follow-up scams: After an account’s permissions are changed, scammers may send a small amount of USDT or TRX to addresses with abnormal permission settings and leave messages such as “contact us to remove multisig” in the transaction memo. They may also claim on platforms such as Telegram that they can provide “technical unblocking” or “permission recovery” services, then charge “unblocking fees” or “service fees” to carry out a second scam.
4. PSA
The imToken security team recommends the following precautions:
- Use official channels only: Please download or update imToken only from the official website: https://token.im/
-
Back up your mnemonic phrase / private key properly: Use physical media, such as paper or a mnemonic storage device, to back up your mnemonic phrase and keep it in a safe place.
- Do not take screenshots or photos of your mnemonic phrase/private key, and do not save it in chat apps, cloud drives, emails, notes, or other internet-connected environments. Never share your mnemonic phrase or private key with anyone, for any reason.
-
Be cautious when signing transactions: When interacting with DApps, opening external links, or scanning QR codes from unknown sources, carefully check the signature confirmation page. If the signature page shows “account permission update”, “Owner Permission”, or similar content, stop the operation immediately.
- Note: imToken does not currently provide TRON multisig setup or multisig transfer features.
- Stop using compromised addresses immediately: If you find that your TRON wallet can only receive tokens but cannot transfer them out, or if you encounter a signature error when transferring, stop using the address immediately. Do not transfer any more tokens into it, and do not trust any so-called “remove multisig” or “recover permissions” services.
⚠️ If your mnemonic phrase or private key has been compromised—or may have been compromised—move all assets held at other addresses or on other networks derived from the same mnemonic phrase to a new wallet created with a brand-new mnemonic phrase as soon as possible.
5. How to check account permissions
- Open your TRON wallet, switch to the Browser page, enter the official TRON explorer URL https://tronscan.org/ and visit the site.
- Enter your wallet address in the search bar. On the account details page, scroll down to the Permission section.
- Check the Owner Permission section and see whether any unfamiliar address appears.
- Normal status: Only your own address appears under each permission, and both the weight and threshold are 1.
- Abnormal status: If an unfamiliar address appears under the account permissions, stop transferring any tokens into this address immediately. You can also contact us through Support & Feedback in the imToken App for help checking the situation.