TL;DR: The wallet is real and the USDT is real. You will still never move it. The seed phrase opens the account, but someone else's key controls it. On TRON this is done with account permissions, a feature most wallets never show you. The same trick can be used against your wallet, and once it happens, revoking approvals won't help.

The bait

It shows up as a YouTube comment, a Telegram "accidental" message, or a screenshot in a P2P chat:

"Can someone help? I have 12 words but no idea how to withdraw. Wallet has 8,000 USDT."

You import the phrase into TronLink. It works. The balance is there, and it's real USDT on the real contract. You press Send and the transfer fails. Usually it's a "permission denied" or signature error, or the wallet says you need TRX for energy.

So you send 50 TRX "for fees" and try again. It still fails, and the TRX you sent is gone.

You didn't find a wallet. You walked into a honeypot.

What's actually happening: TRON account permissions

Every TRON account has a permission layer above its private key, and most people never see it:

• Owner permission. Full control. It can sign anything, including changes to the permissions themselves.
• Active permissions. Up to several custom groups. Each is limited to specific operations (transfers, contract calls, staking and so on).
• Witness permission. Used only by Super Representatives for block production.

Each permission has a threshold and a list of keys with weights. A transaction is valid only when the signatures it carries add up to the threshold.

By default, your own key has weight 1 and the threshold is 1, so you alone control everything. Nothing stops an account owner from changing that with an AccountPermissionUpdateContract transaction:

• The owner permission is moved to the scammer's address.
• The leaked key is left in a permission group where its weight can't reach the threshold, or where it isn't allowed to transfer anything.

The seed phrase still "opens" the wallet, because TronLink happily imports any valid key and shows the balance. But the network no longer accepts that key's signature for transfers. The scammer's key decides, and that key also sweeps any TRX that lands in the account, including your "fee" deposit.

The USDT sitting there is the bait. It never moves, so it can sit there for months and catch hundreds of people.

The same mechanism, pointed at you

The honeypot is the harmless version, because you only lose your gas money. The dangerous version targets your own wallet.

A phishing dApp, a fake "airdrop claim," or a fake "wallet upgrade/verification" page asks you to sign a transaction. In the popup it looks like routine technical noise. In reality it's an account permission update that adds the attacker's key as owner, or rewrites your permissions so their key is required.

After that:

• Your seed phrase still imports fine.
• Your PIN still works.
• Your balance still shows.
• Every outgoing transaction now needs the attacker's signature, or the attacker can move funds without yours.

This is why some "my wallet is hacked" cases don't match the approval-drain pattern we covered earlier. Revoking TRC-20 approvals fixes approvals. It does not fix a hijacked owner permission. If the owner key has been replaced, whoever holds it can block or reverse anything you try.

Red flags before you sign

• A popup mentions "permission," "multi-signature," "account update," or "AccountPermissionUpdate." No airdrop, swap, or "verification" ever needs this.
• The transaction costs an unusually high TRX fee. A permission update carries a large fixed network fee (around 100 TRX), much more than a normal transfer.
• A site insists you sign "to activate" or "to secure" your wallet. Legit wallets don't secure your account by asking a website to rewrite it.
• Anyone gives you a seed phrase. Nobody leaks a funded wallet by accident and asks strangers for help. Any wallet you didn't create is not yours to use.

How to check any wallet's permissions in 30 seconds

Wallet apps rarely show this layer, so check it directly, either before you trust a "found" wallet or as a routine audit of your own.

TRONSEC's Permission Auditor is read-only. There's no wallet connection and no keys, and it shows you:

1. Owner, active and witness groups, with every signer address and its weight
2. Threshold vs. weights, so you can see whether your key can actually sign on its own
3. External controllers, meaning addresses other than the account itself that can act on it
4. Allowed operation scopes for each active group, with risk callouts
5. Recent permission-change history, so you can see if and when someone rewrote the account
6. A 0–100 permission risk score with next steps

👉 https://tronsec.io/app/#permissions. Paste an address and read the result.

For your own wallet, the healthy result is simple: one owner key (yours), threshold 1, no external controllers, no recent permission changes you don't recognize.

For a "gift" wallet, you'll almost always see an owner key that isn't the address you imported, along with a fresh permission update shortly before the bait was posted.

If your permissions were already changed

• Only an active permission changed and you still hold the owner key: you can sign a new permission update that restores the account and removes the foreign key. Do it from a clean device, then move funds to a fresh wallet.
• The owner permission was changed to someone else's key: treat the account as lost. Don't send more TRX to it. Move anything you still can, record the TXID of the permission update, and report the attacker's address so others get warned.
• In every case: create a brand-new wallet with a new seed phrase. Don't reuse anything from the old one.

A full first-hour checklist is in our guide: Scammed on TRON: What to Do First.

Bottom line

On TRON, having the seed phrase and controlling the account are not the same thing. The permission layer decides who can sign. Scammers use it to build bait wallets that look funded and can't be drained, and to quietly take over real wallets with a single popup.

Check permissions before you trust a wallet, and never sign anything that touches them unless you started the change yourself.

Further reading on TRONSEC Academy:

• TRON Multisig Permission Scams
• The Shared Seed Phrase Trap
• Owner, Active and Witness Keys Explained

TRONSEC is free, read-only, and never asks for private keys. tronsec.io · Telegram