Lost $280k USDT to a fake TronLink Chrome extension — timeline & attacker addresses inside
On May 4, 2026, our team accidentally installed a fake TronLink extension from the Chrome Web Store. After importing a private key at 12:24 (UTC+8), the attacker gained full control of the wallet within minutes by changing Owner and Active permissions.
Victim wallet: TRGvN2ghpkLKjMor6hqe3J1RWG6EsRATBb
Attacker address: TPiG18y9AipaQgPUhxtgVxbWpGv51biuk1
~826,000 TRX is currently in a 14-day unstaking lock. Total loss: ~$282k USDT.
Has anyone tracked this attacker before? Any suggestions on flagging this to exchanges (Binance, OKX) before funds move?
u/Dear_Wrap1242 — 9 days ago