Oniq Shield

What is address poisoning?

You send USDT to someone. Minutes later a tiny transfer arrives from an address that looks almost the same as theirs — same first characters, same last ones, different middle.

It lands in your history. Next time you pay that person, you copy the address from the history and take the wrong one. The money goes to the attacker.

Nothing about that moment feels wrong: the amount is normal, the address is familiar, you are the one pressing Send.

What is Oniq Shield?

A watch over Tron that reads every block and marks these lookalike addresses as they appear — not when they get used.

It compares an incoming address against the ones you already trusted, looks at who funded the sender and at the shape of the transfer. A fixed threshold on the amount is not enough: raise the sum above it and the attack is back.

Every threat we find is public on the monitor, with the funding trail behind it.

Oniq Wallet

A gasless wallet with Shield built in: it checks the address you are about to pay before the transfer leaves, and covers the network fee for you.

Oniq Shield

Poisoning attack monitor

Scam addresses that imitate the one you already sent to

watching TRON
Total
stolen funds
—
Scam attacks
detected in 24h
—
Total number
of poisoning attacks
—
Poisoning
attack rate
—
Total spent
by attackers
—

Recently stolen

Waiting for confirmed thefts…

Current attacks

Waiting for the indexer…

Active groups

A poisoning transfer needs funding. Whoever paid for it bought the attack, and that link can't be hidden — addresses sharing a funder are one operation.

FunderAddressesSpentStolenActive since
No groups identified yet.

How we count

Every figure traces back to an on-chain transaction you can open in any explorer. Nothing here is modelled or estimated.

A theft counts only when the sender is an address we already recorded as poisoned by that exact attacker, before the transfer happened.

Funding and consolidation are excluded. Attackers move money between their own addresses and pay for gas. Counting those would inflate the total several times over.

The number is a floor, not a total. Transfers we can't tie to a specific poisoning event are held separately. Real losses are higher.

Victim addresses are never published. Naming them would point the next scammer at someone who already lost money once.