TRON user lost $1.7M (5.1M TRX) to attacker via month-long social engineering and terminal command injection.
Security & Exploits ·
On October 2, a TRON user lost control of roughly 5.1 million TRX (approximately $1.7 million) after an attacker spent a month conducting social engineering before executing a terminal command injection. The funds remain held at the victim's address but are inaccessible to him; the attacker has replaced the account's control keys and is waiting for a 14-day unstaking period to conclude on October 16 before attempting withdrawal.
The compromise began when a Telegram account claiming to be an old contact from a mining hosting business—likely a compromised account—initiated friendly conversation after nearly five years of silence. Over the course of a month, the attacker built rapport and eventually scheduled a video call, sending a malicious link resembling a Microsoft Teams URL. When the victim accessed the page on his laptop (where his wallet resided), a fake interface instructed him to run an SDK update command via the Windows terminal. The attacker reinforced this request through chat, using social pressure and technical framing to convince the victim to execute the malicious command between 13:09 and 13:12 UTC.
Within 40 minutes of the successful command execution, the attacker initiated an on-chain AccountPermissionUpdate transaction transferring owner and active permissions to an attacker-controlled key, followed by revocation of delegated energy and unstaking of the entire balance. Evidence suggests the attacker controls a wallet active since April that funded the takeover transaction, and that wallet is connected to a broader group of addresses used since 2020.