On Oct 2 a TRON user lost control of 5,102,539 TRX (~$1.7M). It took the attacker a month of social engineering and one command pasted into a terminal. The funds are still on the victim's address, but he can't use them anymore. The attacker replaced the keys that control the account and is now waiting for the 14-day unstaking period to end on Oct 16 at 14:16 UTC. How it started: It started on Sep 1 with a Telegram message from an old contact from the mining hosting business. Their chat went back to 2021, so nothing looked off. The contact's account was most likely hacked. After almost 5 years of silence he wrote "Long time no talk, how are you?" He sent a couple of friendly messages without asking for anything and then went quiet until Sep 28. Next, on Sep 28 he apologized for the long silence, suggested a call and sent a link to a Google Calendar booking page for a "30 min chat". On Oct 2 the victim asked to call a bit earlier and suggested Yandex Telemost. The attacker said he would send his own meeting link. It looked like http://teams.live.com. On the phone the link opened a fake page saying the organizer didn't allow mobile access. "Try again on your laptop." So the victim moved to his laptop, where his wallet was. On the laptop the page got stuck on "Joining the meeting...". The attacker wrote that Teams was having some issues. When the victim asked to switch to Yandex, he refused and said his partners were already working in Teams. Around the same time the fake page showed a notice that the TeamsFx SDK had been deprecated, with a Copy button and instructions to press Win+R, type cmd, paste and hit Enter. In the chat the attacker pushed the same thing. He asked "Did you update the SDK yet?", said he once had the same problem and an SDK update fixed it, and told him to paste the update command into the terminal. This is a ClickFix attack. At first it didn't work because the victim kept pasting the command into the Win+R window and getting an error. The attacker sent screenshots showing where to find the terminal and wrote "Click here and type terminal". The command ran between 13:09 and 13:12 UTC, and the victim replied "seems to have worked". After that the attacker kept him talking. He said he couldn't find him in the meeting, offered to move the call by a few hours and chatted about miners and regulation until 13:32 UTC. Then he went quiet. About 40 minutes later things started happening on-chain. At 14:13:24 UTC an AccountPermissionUpdate signed with the victim's key moved the owner and active permissions to the attacker's key. Since then the victim can't sign any transaction from his own address. The attacker then revoked all delegated energy and unstaked the whole stake. Unstaked TRX can only be withdrawn after 14 days, so he has to wait. 555,688 TRX from Oct 16, 14:16:00 UTC 4,546,851 TRX from Oct 16, 15:13:30 UTC Until then the 5.1M TRX stays on the victim's address and neither of them can move it. The attacker also made a mistake. Changing permissions costs 100 TRX and the victim's address was about 28 TRX short. So 51 seconds before the takeover he sent 87 TRX there from another wallet, its whole balance. The two transactions were signed 42 seconds apart, which means whoever did the takeover also had the key to that wallet. That wallet isn't new. It has been in use since April. It received payments and sent funds to exchanges that do KYC, and it's connected to a group of wallets active since 2020. He paid for the attack from a wallet with a history. Victim's address, now controlled by the attacker: TYYDe2Ca7fQapzZg2TZMCBXc3Xb4EbB3EZ Attacker's key: TEdNZQAw44xkw9b7KWpfL5SHdB3aLGWt6p Takeover tx: c608edc5b3ddfd6a15f82715edb3cb750aabb362a080d990cddfb5994f41ee05 If you run an exchange, swap service, bridge or OTC desk on TRON, please flag these. A few more details about the attacker. - The fake domain teans-lives[.]com was registered on Oct 1 at 05:53 UTC, about 31 hours before he sent the call link. It's on clientHold now. - The fake Teams page with the "TeamsFx SDK" story is the same lure used in a campaign that was publicly linked to the North Korean group UNC1069 in April. This doesn't mean it's them, the lure is just the same. To the attacker. You spent a month earning trust and now you're waiting for the unlock. You also paid for the takeover from a wallet with a history. The whole chat, every screenshot you sent, your domain and every on-chain step are documented. The address is flagged in AML screening and shared with exchanges, swap services and bridges. Red flags: - an old contact suddenly comes back and wants a call - the other side refuses your meeting link and insists on theirs - a meeting page says mobile isn't supported and asks you to switch to a laptop - any page asks you to paste a command into a terminal or Win+R If you already ran something like this, assume the device is compromised and move funds from a clean one right away. In this case the attacker needed about an hour.