tronify.rent: the Tron energy site that drained 88,103 USDT from 71 wallets

On October 4, the investigator @rugpullfinder flagged tronify.rent, a site that sells Tron energy, and listed twelve wallets linked to it. Victims had reported losing their USDT after using it.

We traced it with Iris. tronify.rent isn't a fake energy shop: it's a USDT drainer. Since July 26, it has emptied 71 wallets of 88,103 USDT. The same operator ran the same trick through earlier wallets since August 2025, for about $1.03 million in all. About 72,000 USDT is still sitting in four wallets, none of them frozen yet.

The evidence: the Explorer board and the case report.

How the drain works

On Tron, sending USDT costs energy. Energy can be rented, and tronify.rent offers exactly that. Here is what happens on chain when someone uses it:

1. The bait. The drainer wallet (TV6n…s5rv) sends the visitor 15 to 16 TRX, enough to pay for the next step.
2. A real rental. The visitor pays about 7.3 TRX to a genuine energy-rental service, which delegates energy to them. That part is real, and it makes the whole thing look legitimate.
3. The signature. The visitor signs one transaction: an unlimited approval that lets the drainer move their USDT.
4. The drain. Seconds later, the drainer uses that approval to take every USDT in the wallet.

One example, on September 28: a victim signed the approval at 10:34:09 UTC. At 10:34:12, three seconds later, 1,419.70 USDT was gone.

Between July 26 and October 4 there were 82 successful drains like this, and 759 more attempts that failed because the wallet had nothing left to take.

The victims

• 71 wallets drained of 88,103 USDT, from July 26 to October 4, 2026.
• 44 of them in September alone, for 53,836 USDT.
• The median loss is about 210 USDT. The largest: 13,472, 12,359 and 8,811 USDT.

The original post counted about 80 victims and $69,651 in one month. The victim count fits what we found on chain. The amount doesn't match any one-month window: the total over the ten weeks is higher.

Not a first attempt

The two wallets behind tronify.rent, the drainer and the collector (TLv3…7tpJ), were funded 39 seconds apart on July 22 by the same wallet, TAaB…13vY. That wallet ran the same trick before: 295 wallets, 358,440 USDT, between May and September 2026.

TBS4…ZmBS, one of the addresses in the original post, is an earlier drainer from the same operator: 785 wallets, 587,282 USDT, from August 2025 to August 2026. It sent the new drainer 200 TRX on July 25, two minutes before its first drain.

Altogether, about 1,150 wallets and $1.03 million in USDT since August 2025, with the same 15 TRX bait and the same approval trick, and new wallets every few months.

Where the money went

• 51,000 USDT to TDDf…zs9M: 36,000 from the collector and 15,000 from the drainer. It still holds 50,901 USDT.
• 24,000 USDT to TVkR…herw, which still holds 16,581 USDT. From there, 7,200 USDT was swapped to BNB through Bridgers, in orders made through Trust Wallet's swap, landing at 0x8ab3…0314 on BNB Chain.
• In the earlier phase, 18,220 USDT took the same route to BNB Chain.

One detail stands out: TVkR…herw was funded by a 983.97 USDT withdrawal from Bybit on August 31. Bybit's records show who requested that withdrawal.

Still freezable

None of it has been frozen yet:

That's about 72,000 USDT that Tether can still freeze, most of it in a single wallet.

Not every address on the list is the scammer's

Of the twelve addresses in the original post:

• two are victims, drained after withdrawing USDT from Bybit;
• one is a victim's Bybit deposit address;
• one is the real energy-rental service victims paid in step 2, which never received stolen funds;
• three were never drained: two received the TRX bait and didn't sign, and the third appears to belong to the same owner as one of them.

Mixing those up would point exchanges and Tether at the wrong wallets. That's why each address on the board is labelled with what it actually is.

How to stay safe

• Never sign an approval to rent energy. Renting energy only needs a TRX payment. A site that asks you to approve your USDT wants to take it.
• Free TRX from a stranger is bait, not a gift.
• Check your approvals. If you've used tronify.rent, revoke any USDT approval to TV6n8cCLmX5mRCMMNvcE1K1i87Yo9Ys5rv right away, with a token-approval checker such as Tronscan's.

Note: this is not the separately reported energy service called "Tronify". Nothing on chain links that brand to these wallets. This post is about tronify.rent and the wallets above.

Thanks to @rugpullfinder for flagging the site and the wallets.

Iris traces stolen funds across Tron, Solana, Ethereum and Bitcoin, through bridges, mixers and swap services. Paste any wallet at iriscan.app to start.