The Tron Mining Scam

At first pass the below message might feel legit, after all (at the time of writing) TRX, the native token of the Tron blockchain, had indeed exceeded $4billion — it stood at $5,023,453,540, and it promises that funds will remain in my own wallet.

So how did I know by the 12th word that this was most likely a scam?

“Mining”

Tron’s blockchain has a consensus algorithm which is Delegated Proof of Stake (DPoS). Whilst I won’t go into all the technical details of this (maybe I’ll leave for a Monday post) the key thing to note is that in a DPoS or Proof of Stake (PoS) consensus model, like Ethereum has, you do not “mine”, you “stake”. This means that instead of nodes on the network processing transaction by competing to solve cryptographic puzzles, instead nodes put up a stake, which operates like a behavioural bond, with the chance of being randomly selected to process the next block.

In addition, Tron’s annual staking reward yield is around 5% so daily profits of between 1–6% were certainly on the higher end 🤑.

However maybe Jenny had just confused staking and mining — a simple mistake to make, and maybe the yield was generated from off protocol activity too. So of course I contacted her on Telegram to find out more…

One thing about Telegram crypto scammers worth noting is that they are rapid at replying! Within one minute of my message to TronMaria, I had a reply and the conversation about how I could scoop some juicy TRX profits had begun. The first question I had for her, how did mining work on Tron? I got this wonderful response:

“Liquidity mining is a way to earn more digital currency by holding it. Through a magical computer program called a “smart contract”, USDT (Trc20) is used as computing power in your digital wallet. The rewards of the service are returned to participating users in the form of digital currency. Simply deposit USDT into your trusted wallet and obtain a mining node certificate. You can earn a steady income every day.”

🤣🤣🤣

A wonderful example of throwing some blockchain terms into a sentence and hoping that no-one realises that it’s absolute garbage!

To explain how I’d make a profit from this magical process, Maria outlined that:

“After successfully participating in the campaign, you need to log in once every 24 hours and click on the website to collect your earnings {there will be a prompt}, you can also share it with your friends and you can get an extra 20%-30% bonus”.

She also explained the tiered reward structure so the more I used to mine, the higher my return:

• Phase 1: 10–2000USDT, receive 1.6% every 24 hours on USDT held.
• Phase 2: 2000–5000 USDT, receive 2.4% on USDT held every 24 hours.
• Stage 3: 5000–10000 USDT, 3.2% of USDT held every 24 hours.
• Stage 4: 10,000–50,000 USDT, 4.8% of the USDT held every 24 hours.
• Stage 5: Above 50,000 USDT, 7.6% of USDT held every 24 hours.

And of course …

✅ Guaranteed returns

✅ More in = higher returns structure

✅ Referral bonus

✅ Technically nonsensical

So far, we’re looking pretty scammy!

She advised me to download the Assure wallet and sent a link to the google play store. I checked that the link wasn’t malicious and also did some googling to understand more about this wallet since it was a new name to me. It had just 10k downloads but a flurry of recent 5 star reviews all claiming it to be the best thing since sliced bread.

I know that a common practice for scammers is to create malicious crypto apps and steal from users who download them onto their devices so since this isn’t a wallet I recognise I didn’t download it. Just as in the non-crypto world, always be careful with links and apps that you don’t recognise, and when in doubt … don’t download!

Maria then guided me through the app set up, giving me a white glove service of what to click and where, including screenshots to accompany her instructions (which I’m using here). I didn’t have the app so was just hoping she wouldn’t start asking for screenshots back since that would require my amateur paint-editing skills from whatever images online I could find!

Also note that she’s suddenly become dennis101 …. 🤷

After ensuring I had added the Tron supported USDT token to my wallet, she directed me to use the in-app search for a website which purported to be a Tron mining pool.

As I didn’t have the app I used a safe search tool to see where this would direct me to:

So pretty unmistakable warning signs that the website was not going to be dishing out my magical mining rewards, but would instead be looking to pillage my TRX and USDT from a connected wallet, or even try to connect into my Metamask and swipe my NFTs and ERC20 tokens from there!

I pretended to Maria that the app was failing to load and asked if I could use the link through my computer instead but she was insistent that the Assure wallet would need to be used. This fueled my suspicious that Assure could be a malicious wallet app so I checked on LinkedIn for any Assure employees and reached out to a community manager who claimed to have 8years experience in the crypto industry and who had a long list of community manager positions at various crypto firms, many well known names. She was unable to help me as she said she’s already left the project and then a few weeks later I saw the following activity from her account which raised my suspicions more …

At this point I had enough warning signs that this was a scam and whilst I wasn’t able to grab any specific crypto addresses which were associated to understand the magnitude of the scam hopefully reporting this account to Telegram and outlining the scam here will at least help avoid anyone else falling for it!

Originally published at https://www.linkedin.com.