TRON Drainer Tracker
September 18, 2026 · View on GitHub
Defensive chain monitor: watch TRON mainnet (TRC-20) for new scam contracts used in USDT approval phishing — not a drainer kit.
Chain-wide watcher for USDT approval phishing — unlimited approve / increaseApproval to malicious spenders, then Verify20, transferFrom, or operator sweeps. Tracks VerifyAccount kits, heyue-style contracts, and sweepers on TRON mainnet only (not Ethereum, BSC, or other chains).
Chain: TRON · Token: USDT TRC-20 (
TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t) · APIs: TronGrid + TronScan
Built by TRONSEC — free TRON security tools for users: phish check · TX decoder · approvals.
What this repository is (read this first)
Classification: security research · threat intelligence · user protection
Intent: detect and warn about scam contracts — never to deploy or operate them.
| This repo | Read-only Python monitor that polls public TronGrid / TronScan APIs, matches known drainer contract patterns, and stores addresses in a SQLite IOC registry (optional Telegram / webhook alerts). |
| Same org as | tronsec — open-source TRON security terminal (tronsec.io/app), read-only, no wallet connect in OSS. |
| Audience | Security researchers, analysts, operators building blocklists — and TRON users who want early warning when new VerifyAccount-style spenders appear. |
What this repository is not
- Not malware, a wallet drainer, phishing kit, or exploit code
- Not a tool that connects to wallets, collects seed phrases, or asks users to sign transactions
- Not code that calls
Verify20,transferFrom, or sweep functions as an attacker — it never moves victim funds - Not instructions to build scam dApps — we document method names (
Verify20,Verify10, …) only because they appear in already-deployed malicious contracts on TronScan (same idea as AV signatures referencing malware API names)
Why the word “drainer” in the name? Scammers deploy “drainer” contracts; this project tracks those contracts defensively. Automated platform filters sometimes misclassify that wording — if you are reviewing this repository, it exists to reduce approval-phishing harm, not to enable it. See SECURITY.md for allowed / prohibited use.
Why this exists
TRON is the #1 chain for USDT volume — and the #1 chain for approval phishing.
The scam is old. The contracts are new every week. Victims sign unlimited USDT approve on a fake “verify account” page. Operators rotate clones constantly. By the time a static blocklist updates, victims may already be drained.
This tool flags new malicious spender contracts when they first appear on-chain — from public Approval events and deploy patterns, without a victim database.
What it watches
| Signal | Source |
|---|---|
Unlimited USDT TRC-20 Approval events | TronGrid — new spender addresses |
| Deploy txs from known operator bot wallets | TronScan — seeded drainer deploy wallets |
| Drainer ABI patterns | Verify20, Verify10, trc20Withdraw, sweep, controlAndTransferToken, … |
Hits are stored in a SQLite registry with optional Telegram / webhook alerts.
Typical flow:
- Victim connects on a fake TRON dApp / “verify account” page
- Victim signs unlimited USDT approve to a new contract
- Operator calls
Verify20/transferFromand drains USDT - This tool flags the spender contract at discovery time
Python 3.10+, stdlib only — no pip install.
Quick start
git clone https://github.com/jamejohns/tron-drainer-tracker.git
cd tron-drainer-tracker
cp config.env.example config.env
# Edit: TRONGRID_API_KEY + TRONSCAN_API_KEY
bash install.sh
./bin/drainer-tracker scan
./bin/drainer-tracker watch --interval 300
Requirements: TronGrid Pro (USDT Approval events) + TronScan API (contract ABI + tx history).
Example output
[18:42:11] 2 new drainer(s), 2 added to registry
TWVgLeooDYD3m9jHt85YJiXXLBWcYKUH79 verify_account tx=63 'VerifyAccount'
TN5xRz83rNcAF9vbxcnuacERbUteeGesLr verify_account tx=7 'VerifyAccount'
registry: data/drainers.db (2 total)
Commands
| Command | Description |
|---|---|
scan | One-shot TRON scan for new drainer contracts |
scan --notify | + Telegram / webhook on new hits |
watch [--interval 300] | Daemon loop (poll every N seconds) |
list [--since 7d] [--type verify_account] | SQLite registry |
status | Stats + recent contracts |
export [--format csv|json] | Export registry |
import-alerts alerts.json | Import historical alerts |
notify-test | Test alert channels |
Configuration
Copy config.env.example → config.env:
export TRONGRID_API_KEY="your-trongrid-pro-key"
export TRONSCAN_API_KEY="your-tronscan-pro-key"
# optional alerts
export TELEGRAM_BOT_TOKEN=""
export TELEGRAM_CHAT_ID=""
export WEBHOOK_URL=""
See config.env.example for scan tuning (DT_APPROVAL_PAGES, DT_INTERVAL, …).
Drainer types detected
| Type | Markers | Example scam |
|---|---|---|
verify_account | Verify20, Verify10, name VerifyAccount | Fake “account verification” dApp |
operator_drainer | trc20Withdraw | Operator pulls approved USDT |
sweeper | sweep( + admin methods | Batch sweep approved tokens |
heyue / approve kits | controlAndTransferToken | Fake bill → unlimited approve → drain |
Reference seeds and operator bot wallets: lib/tron_hunt.py.
Live IOC examples (2026-09-02)
Defensive research — verify on TronScan before acting.
| Contract | Type | Notes |
|---|---|---|
TWVgLeooDYD3m9jHt85YJiXXLBWcYKUH79 | VerifyAccount | Active · 63 txs · Verify20 / Verify10 |
TN5xRz83rNcAF9vbxcnuacERbUteeGesLr | VerifyAccount | Fresh clone · 7 txs · TXnDibB9 kit family |
If you approved USDT to an unknown spender → check approvals and revoke.
Official USDT (TRON): TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t
Scope & limitations
- ✅ TRON mainnet TRC-20 contracts (USDT-focused discovery)
- ✅ Read-only: TronGrid events + TronScan + simulate probes
- ❌ Not Ethereum ERC-20, BSC, Solana, etc.
- ❌ Does not scan your wallet — watches new malicious contracts chain-wide
- ❌ Defensive / research only — no exploitation
See SECURITY.md.
Systemd (VDS / Linux)
sudo cp systemd/drainer-tracker.service /etc/systemd/system/
sudo systemctl enable --now drainer-tracker
sudo journalctl -u drainer-tracker -f
Project layout
bin/drainer-tracker # CLI entrypoint
drainer_tracker/ # registry, notify, CLI
lib/ # TronGrid / TronScan hunt logic
data/
├── drainers.db # SQLite registry
├── watch-state.json # dedup state
└── last-scan.json # latest scan output
systemd/ # optional daemon unit
Related
| Resource | Link |
|---|---|
| TRONSEC app (users) | https://tronsec.io/app |
| OSS TRON security toolkit | https://github.com/jamejons/tronsec |
| X article (walkthrough) | https://x.com/tronsec_io |
License
MIT — see LICENSE.