> For the complete documentation index, see [llms.txt](https://help.tokenpocket.pro/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.tokenpocket.pro/en/security-knowledge/common-fraud-cases/malicious-multisig-scams-on-tron.md).

# Malicious Multisig Scams on TRON

### What Is Multisig?

Multisig, short for multi-signature, is a security mechanism that allows a wallet to be jointly managed by multiple addresses.

A wallet can be configured with multiple signing addresses, each with a specific weight, as well as a signing threshold. A transfer or other on-chain action can only be completed when the combined weight of the participating signers meets the required threshold.

### How Multisig Should Be Used

Multisig is a legitimate security feature commonly used to manage team funds, institutional assets, and high-value wallets. Its main benefits include:

* Preventing assets from becoming inaccessible if a single private key is lost;
* Preventing funds from being transferred if one private key is compromised;
* Requiring approval from multiple parties before funds can be moved;
* Reducing the risk of human error and internal mismanagement.

When used correctly, multisig can significantly improve asset security. However, if a wallet’s account permissions are maliciously modified, this feature can also be exploited by scammers to take control of the wallet.

### What Is a Malicious Multisig Scam on TRON?

Malicious multisig scams are particularly common on the TRON network. In this type of scam, an attacker adds their own address to a wallet’s permissions or changes the signing weights and threshold without the user’s knowledge. As a result, the user can no longer manage the wallet independently.

A compromised wallet will typically show the following signs:

* The wallet address and assets remain visible;
* The seed phrase or private key can still be imported;
* Transfers and other wallet operations cannot be completed;
* The attacker can use their permissions to control or transfer the assets.

Having the seed phrase or private key does not necessarily mean that you still control the wallet. On TRON, the ability to transfer assets and perform other actions depends on the account permissions recorded on-chain.

> **A malicious multisig compromise should be treated as wallet theft. Even if the assets are still visible, you have already lost effective control of them.**

<mark style="color:red;">Once a wallet has been maliciously configured as a multisig wallet, generally you cannot restore its permissions. Anyone claiming that they can recover is a scammer.</mark>

### How to Prevent from Multisig Scams

* Do not click deposit, airdrop, or promotional links sent by strangers;
* Do not download wallet apps from unverified sources;
* Never disclose your seed phrase or private key to anyone;
* Carefully review the transaction type and risk warnings before signing;
* Stop immediately if you see prompts such as **“Change Permissions”** or **“Update Account Permissions”**;
* Do not transfer additional funds to a wallet with abnormal or compromised permissions.

If you suspect that your wallet has been maliciously configured as a multisig wallet, stop using the address immediately and do not transfer any additional assets to it.

> **Security reminder:** Multisig itself is not a scam. The risk comes from account permission changes that you did not knowingly authorize. Never sign a transaction you do not understand, and exercise particular caution whenever an action involves changing account permissions.

If you encounter a suspected scam link, please report it to us at **<service@tokenpocket.pro>**. Once verified, we will add a local risk warning for the link to help protect other TokenPocket users.