Tracking a Novel Scheme to Launder Tether on Tron Blockchain

Blockchain intelligence firm Global Ledger said the fraudsters used Tron staking to launder the stolen funds


STEVLTH/ modified by Blockworks


Around $775,000 of stablecoin USDT was allegedly stolen in a phishing scheme on the Tron network, according to an investigation by risk assessment firm Global Ledger.

Global Ledger claims the funds were laundered via the TRX staking mechanism. Staking on Tron involves delegating TRX tokens to one of 27 Super Representatives, the network’s version of a validator node.

Global Ledger said the fraudsters used the SunSwap exchange to get USDT for Tron in a certain wallet. They then used TRX for staking to verify their transactions and cover transaction fees, Global Ledger said. 

The staking volume enabled the thieves to elect a specific Tron validator called “metaverse home,” a representative from Global Ledger told Blockworks. “Together with the wallet that collects the profit, approximately 100 phishing wallets participate in voting to help ‘metaverse home’ be chosen as a validator.”

With “metaverse home” selected, the validator receives the opportunity to create transaction blocks and receive a reward of 16 TRX for each block, the representative added.

“Proceeds were not cashed out through exchanges, in which case they can be traced and seized by law enforcement,” a representative from Global Ledger told Blockworks. “They were used to vote for the validator, [to] earn the cleanest money possible, [freshly] mined coins.”

The use of USDT is incidental and “metaverse home” is not linked to Tether, Global Ledger said, but its status and ability to earn money validating the blocks is certainly based on funds received from phishing USDT.

The nature of the scam shows how automated voting for a super representative can in ways permit this type of scheme, Global Ledger said. 

“This is the first time we see such a laundering scheme,” a representative from Global Ledger said, noting that the scheme’s scale and sophistication indicates a business-like venture.

“These guys may have Slack, Jira and daily stand-ups like any other startup,” they said.

Updated Feb. 27, 2023 at 2:56 pm ET: An earlier version of this story misstated the total amount of stolen USDT.

Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the On the Margin newsletter.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.


Upcoming Events

Salt Lake City, UT

MON - TUES, OCT. 7 - 8, 2024

Blockworks and Bankless in collaboration with buidlbox are excited to announce the second installment of the Permissionless Hackathon – taking place October 7-8 in Salt Lake City, Utah. We’ve partnered with buidlbox to bring together the brightest minds in crypto for […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research



Aerodrome is a "MetaDEX" that combines elements of various DEX primitives such as Uniswap V2 and V3, Curve, Convex, and Votium. Since its launch on Base, it has become the largest protocol by TVL with more than $495M in value locked, doubling Uniswap's Base deployment.


Plus, Imran Khan’s intriguing experiment on the speeds of crypto onramps


The SEC has signaled a timeline to issuers that could lead to a July 23 launch for the ETH funds, people close to the process told Blockworks


PayPal has unequivocally made a name for itself as a crypto adopter among fintech giants


Also, a look into how the highly-debated SAB 121 could end up shaking out for crypto custodians


Vance, an Ohio Republican, is largely seen as crypto-friendly


Plus, all the world is green as prices across the crypto space rally, with solana reaching a nearly two-week high