Trust Wallet's own numbers are the cheapest way to price the trade: more than 225 million detected poisoning attempts against more than $500 million of confirmed theft [8] works out to about $2.22 of realised loss per attempt [1], which only functions as a business if seeding an attempt costs a fraction of that, and Cryptopolitan has documented that cheap Ethereum gas is exactly what makes mass dust sending viable, to the point of padding the network's daily transaction counts [10]. The Bofur Capital loss shows the same ratio from the other end: 0.0002 USDC of bait, roughly $2 million gone twenty hours later [11], a return of about ten billion to one [2].
Set against that, the Tron operator looks less like an outlier than like the same arithmetic run on an unwatched surface. Fifteen wallets, $9.4 million, four weeks [1] is about $627,000 per victim [3] and roughly 1.9% of the entire confirmed total Trust Wallet has counted [5], booked by a single operator on one chain.
The detection that does exist is narrow by construction. MetaMask's rule fires when a destination's first and last four characters match a previous recipient while the middle differs [6]; Trust Wallet's March feature compares the address against a database of known scam addresses and shows a side-by-side view on a match [7]. One is a string heuristic, the other a blocklist, and both were built for EVM chains such as Ethereum, BNB Smart Chain and Polygon rather than Tron [5], which is where this operator swapped balances into USDD and funnelled them into one consolidation wallet [4].
Now the part that complicates my own read. Bofur was pulling funds off Compound and the thief moved the proceeds into DAI to stay ahead of a freeze [12][13], all of it inside the EVM perimeter where the protections nominally live, and about $2 million left anyway [11]. So there are at least three ways this resolves. Vendors port the checks to Tron and the operator's yield falls, making it a coverage story. Or the losses track which wallet a victim used rather than which chain they were on, in which case porting changes little. Or, the more interesting version, Specter's attribution of all fifteen drains to one operator is a read of a single consolidation address [2][4], and the four-week figure bundles losses that were never one campaign.
This is probably wrong, but I would put the binding constraint on the interface rather than the chain: addresses run 42 characters on Ethereum and most wallets display only the first and last few [15], which trains an eye to verify eight of them, and the two victims who lost $2.5 million each [3] were not people with small balances or no process. The test is observable. Ship Tron coverage, then compare the following four weeks against these.
Meanwhile the burden sits where it costs the vendors least. The published guidance is to verify every character, keep trusted addresses in an address book and send a small test transfer before a large one [17], and Changpeng Zhao asked after a $50 million theft in December that wallets check and block poison addresses outright [16]. Guidance ships for free; a Tron-side blocklist is a budget line, and the $9.4 million landed on fifteen wallets rather than on two roadmaps [1][5].
