Why TRON fraud cases reveal so many wallets

A pattern that is regularly observed in crypto forensics.

Anyone who investigates fraud cases across different blockchains is familiar with this impression: In TRON cases—especially with USDT according to the TRC20 standard—significantly more intermediary and distribution wallets are often involved than in comparable cases on Bitcoin or Ethereum. What starts as a simple payment method quickly develops into a complex network within just a few transactions.

First, a point of clarification that is usually missing in such articles: This impression is an observation from case work, not a measured quantity. We are unaware of any reliable study that compares the average number of addresses involved per case across networks—and such a comparison would also be methodologically problematic, because "address" means something different on a UTXO network than on an account model. Nevertheless, the pattern can be explained by several interacting factors.

New TRON addresses cost almost nothing.

A TRON address is created locally by generating a key pair. It only exists on the network after activation. This is done by replacing an already active TRX address or a TRC-10 address.Token The sender sends the data to the new address. They pay an account setup fee of 1 TRX, which is then used up. If they don't have sufficient bandwidth, an additional 0.1 TRX is added.

To compare ongoing costs: Every activated account receives 600 free bandwidth points daily. A USDT transfer occupies approximately 345 bytes and therefore 345 bandwidth—the free allowance thus covers about one transfer per day and address. If this is insufficient, the network charges 1,000 sun (0.001 TRX) per additional byte.

For fraudulent organizations with a division of labor, this means that the threshold for using ever more receiving, intermediate, and distribution addresses is in the range of a few cents per address. Hundreds of addresses can be generated automatically and activated as needed. A single organization can maintain a large number of wallets, each used only briefly, without incurring significant costs.

Bandwidth and Energy: the Resource Model

TRON doesn't price transactions with a single fee, but rather with two resources. Bandwidth covers the byte size of a transaction. Energy covers the computing power that the TRON Virtual Machine uses for a smart contract call. TRC20 transfers—including every USDT transfer—are contract calls and therefore require energy.

Unlike Bandwidth, Energy doesn't have a free allowance. Those who don't have any Energy pay for it via a TRX burn. The amounts are stable and easy to calculate:

The surcharge for the first transfer to a "new" address has a technical reason: An entry must be created for it in the credit allocation within the USDT contract. This can also be used for forensic purposes—the doubled energy consumption marks first-time recipients.

However, another characteristic is crucial for fragmentation: the delegation. Those who stake TRX receive bandwidth and energy and, since the Stake 2.0 model, can delegate these resources to any other account without transferring the staked TRX itself. The receiving wallet uses the recipient's resources without having to hold any TRX itself. According to the TRON documentation, energy delegation is significantly more common than bandwidth delegation because the free bandwidth allowance is usually sufficient for everyday use.

This allows a central infrastructure to support any number of operational wallets. This is efficient for exchanges, payment service providers, and DApps. Criminal organizations exploit this same feature: many receiving wallets are centrally supplied with resources and then used for USDT transfers.

The energy market — and why it destroys an investigative heuristic

A commercial market has sprung up around delegation. Numerous providers rent out energy by the minute or transaction and delegate it automatically to the customer's wallet. Commercial energy providers can significantly reduce the costs compared to a full TRX burn. For perpetrators, this further reduces the cost of an additional layering step.

From a forensic perspective, this leads to a warning that is missing in many guides: A common delegation source does not necessarily imply a common operator. An energy provider delegates to thousands of completely independent customers daily. Two suspicious wallets that received energy from the same address could simply have subscribed to the same service provider. Before a delegation relationship can be considered as ClusterIf the -indicator is used, it is therefore necessary to check whether the delegating address is a commercial provider — recognizable by a very high number of recipients, uniform delegation amounts and short, automated processing times.

GasFree: since 2025 also without TRX

In March 2025, the GasFree feature was launched on TRON, initially in TronLink. It allows users to send USDT-TRC20 without holding TRX: the fee is deducted from the transfer amount in USDT. Relayer executes the transaction. This is convenient — and it eliminates one of the classic investigative leads.

The question "From which address does the TRX originate that this wallet uses to pay its fees?" is irrelevant for a GasFree wallet: there is no traceable TRX flow. Instead, there is the relayer agreement, which operates for a large number of users simultaneously and therefore does not allow for attribution. Anyone using TRX funding as a linking criterion should therefore first verify whether the wallet in question has ever actually held TRX.

Why the model is attractive for layering

In the context of money laundering, layering refers to the deliberate use of multiple transaction layers to conceal the origin, control, and ultimate whereabouts of assets. The cheaper an additional step is, the less incentive there is, from a perpetrator's perspective, to use a large number of intermediate wallets. At costs of just a few cents per step, the economic barrier practically disappears.

A typical TRON case therefore often shows a structure like this:

It is important to note that a large number of involved addresses does not, in itself, prove money laundering or joint perpetratorship. Only the interplay of transaction flow, temporal patterns, funding, resource delegation, counterparties, and other indicators allows for reliable cluster formation.

Why Bitcoin Looks Different

Bitcoin doesn't use an account model, but rather the UTXO principle. Every transaction consumes one or more previously generated, unused outputs and generates new ones. A single transfer can therefore contain multiple inputs and outputs, and every payment with change regularly generates a new change address. Address diversity in Bitcoin thus arises from ordinary wallet management, without anyone intending to conceal anything.

The sheer number of addresses is therefore not comparable between the two networks. The more important difference lies elsewhere: Bitcoin provides a powerful clustering tool with its Common Input Ownership heuristic—if multiple inputs are issued in the same transaction, there is strong evidence that the same party possesses all the associated keys. An account model like TRON offers nothing comparable. Every transaction has exactly one sender. Anyone wanting to group wallets on TRON has to rely on weaker indicators: time patterns, amount patterns, common counterparties, activation, funding, and delegation. This is precisely why a TRON graph appears less clear—not only because it has more nodes, but because these nodes are more difficult to group together.

Ethereum: same account model, different cost logic

Like TRON, Ethereum uses an account model. Technically, any number of addresses can be generated. The difference lies in the cost structure: Each transaction costs gas, payable in ETH, and smart contract interactions—which include… ERC-20Transfers consume significantly more gas than a simple ETH transfer. The sender pays the fee, which fluctuates with network load.

Each additional layering step on Ethereum therefore generates immediate and difficult-to-calculate costs. This doesn't prevent wallet hopping, but it does introduce a noticeable economic friction that is absent in a system where resources are staked centrally once and then delegated to operational accounts as often as needed. However, it should be noted that transaction costs are now also very low on Ethereum Layer 2 networks, so this argument is less compelling there.

The change of perspective: not just following USDT

In TRON cases, an examination should not focus solely on the visible USDT-Flow Focus on this. Equally revealing is the question of how the accounts involved were technically made operational in the first place. Four infrastructure traces are relevant here:

• Account activation: Which address first activated the new wallet using TRX or a TRC-10 token? This trace is particularly reliable because it is unique and irreversible.
• TRX funding: From which addresses did the TRX holdings originate from which fees were paid — assuming the wallet ever held TRX at all (see GasFree).
• Resource delegation: Are energy or bandwidth being repeatedly delegated from the same accounts to multiple suspicious wallets — and is this a commercial landlord or a private source?
• Permission structure: TRON uses its own permission model with Owner, Active, and Witness permissions. Control of an account can be transferred to another address via AccountPermissionUpdateContract—without moving any funds. Recurring permission controllers across multiple wallets strongly suggest shared control.

These traces can connect wallets whose USDT payment methods appear independent at first glance. If five victims pay into five different TRON wallets, but these wallets are all activated from the same source or controlled by the same account, an additional cluster clue emerges.

Analyze asset flow and infrastructure flow separately.

For robust TRON forensics, a two-stage model is recommended:

The combination of both levels is regularly more informative than purely linear transaction tracking. An attacker can extend the asset flow through any number of intermediate wallets; however, the underlying operational infrastructure still needs to be activated, funded, and resourced. It is precisely there that recurring patterns emerge—unless, as described above, they are obscured by commercial services.

What a high number of wallets does not necessarily mean

Not every wallet in a TRON graph belongs to a perpetrator. Among the addresses involved are regularly exchange deposit addresses, hot wallets, payment service providers, energy providers, automated service wallets, legitimate DApp infrastructure, and accounts of money mules who were themselves defrauded.

Attribution should therefore never be based solely on "wallet proximity" or a high number of transfers. A comprehensive assessment is required, considering on-chain data, known entity mappings, timing and amount patterns, recurring counterparties, funding and authorization relationships, and—where available—off-chain information. Furthermore, attributions from commercial analytics providers are third-party information. They are useful, but they are not proof and should be clearly identified as such.

The practical leverage lies with the issuer.

Despite all the analysis, it's worth taking a sober look at what ultimately protects wealth. USDT is a centrally issued token: The issuer can block individual addresses, preventing the tokens held there from being moved. This is precisely the most effective leverage in TRON cases—and it is being used increasingly.

Since September 2024, a joint unit, the T3 Financial Crime Unit, has existed. Tether, TRON and the analytics provider TRM Labs, which consolidates requests from law enforcement agencies. According to its own figures, the unit had frozen more than $450 million in incriminating USDT by May 2026; freezes are often carried out within 24 hours of a government request. The vast majority of these freezes affect TRON addresses.

For case management, this results in a clear prioritization: Identifying the current address holding the funds and promptly requesting them from the authorities are more important than completely reconstructing every intermediate step. A perfect chart is of little use if the funds have meanwhile flowed out via an off-ramp. It should also be noted that a freeze does not guarantee recovery: The tokens are frozen, and their release is determined by a legal process.

Practical checkpoints for TRON/USDT-TRC20 cases

• Determine the current whereabouts of the funds above all else — and, once the address is known, immediately initiate an official request.
• Document the initial activation of each relevant wallet: activating address, time, transaction hash.
• Check the permissions of each wallet (Owner, Active, Witness) and record changes via AccountPermissionUpdateContract.
• Capture initial and recurring TRX funding — and check if the wallet is operating via GasFree instead.
• Collect energy and bandwidth delegations and assess each delegation source to determine if it is a commercial landlord.
• First-time recipients will recognize it by the increased energy consumption (around 130,000 instead of 65,000).
• Analyze the temporal proximity between the victim payment and the forwarding of the payment.
• Separately mark splits and subsequent re-aggregation.
• Identify inflows to stock exchanges, OTC desks and payment service providers and clarify their contact channels.
• Justify wallet clusters only with several independent indicators and specify the evidence depth for each indicator.
• Show asset flow and infrastructure flow separately and only then combine them.

Conclusion

The high number of wallets involved in many TRON fraud cases is no coincidence. It results from inexpensive account activation, a resource model with delegable energy, a commercial energy market, and the dominant role of USDT-TRC20 in the network. These characteristics can significantly reduce the costs of additional transaction stages and make strong fragmentation considerably more economically attractive. Furthermore, the account model lacks the most powerful clustering tool used in Bitcoin investigations.

This has three practical implications. First, simply tracking the USDT flow is insufficient: Analyzing activation, funding, delegation, and authorization structure reveals recurring infrastructure patterns behind a seemingly complex network. Second, these infrastructure traces must be treated with caution—commercial energy leasing and GasFree create connections between wallets that are unrelated. And third, as case studies repeatedly confirm, the fastest way to secure USDT is not via the complete graph, but rather via the currently leading address and the issuer.