AML check on TRON
TRON carries a large share of USDT transfers and of illicit stablecoin flows. Here is how to check a TRON address, which services cover it, and what to watch for.
Address formatStarts with T · 34 characters, Base58CheckTXa9mK3vQe7Lr2pN8sWd4hYc6jBf1uZqm2Example for illustration, not a real address.
Note
USDT on TRON can be frozen by its issuer at the contract level. A clean score lowers the risk of an exchange hold, but it cannot undo an issuer freeze.
Services that check TRON
05ShardUse with careWeb app290 ₽ for 10 checks, down to 15 ₽ a check in a 1,000-check packSupported8.1
09Phalcon ComplianceEnterprise platformFree plan (3 checks a month) · credit packs $1.10–$1.90 a checkSupported6.4
11Cryptomus AML CheckerUse with careWeb app4.4 USDT for 10 checks, down to 0.40 USDT a checkSupported6.3
14AnChain.AI Data APIAPI for businessAddress score $0.08–$0.10 in credit packs from $1,000Supported6.1
21BitHide AML CheckUse with careTelegram botFirst check free, prices not publishedSupportedNot scored
For companies: screening tools that list TRON
Enterprise KYT and wallet-screening platforms for exchanges, payment firms and other businesses. Prices are on request and they are not part of our score. “Screening” means the provider’s own page lists TRON for screening or monitoring; “Not verified” means it is listed only for investigations or without detail. Compare business tools →
01Global Ledger[1]KYT (Know Your Transaction: transaction screening / real-time risk scoring); also KYB and Vision (investigations platform)Quote on requestScreening
How to check a TRON address
- Get the public addressAsk your counterparty for the address they will send from — or copy it from the incoming transaction.
- Pick a service that covers TRONChoose one marked “Supported” in the list above. Check the sender before a P2P trade, not after — once USDT lands from a flagged source you cannot send it back unseen.
- Run the check and read itAn empty history on a new address is “no data”, not “clean”.
A real AML check needs only a public address. Never share a seed phrase or private key.
TRON specifics
- TRON addresses start with T and are 34 characters long in the Base58Check form shown in wallets and explorers.[2]
- A brand-new TRON address is only recognised by the network after it is activated, so a fresh address may show no history at all.[2]
- TRM Labs attributed 58% of illicit crypto volume in 2024 to TRON — the largest share of any network, though down by half from 2023.[3]
- In the same TRM Labs analysis, 49% of TRON’s illicit volume in 2024 was linked to sanctioned entities and 32% involved blocklisted funds.[3]
Who can freeze funds on TRON
- Tether, TRON and TRM Labs set up the T3 Financial Crime Unit (T3 FCU) in September 2024 to work with law enforcement against illicit use of USDT on TRON. In its first weeks it helped freeze more than 12 million USDT linked to a blackmail scam, an investment fraud and other cases.[4]
- Tether describes T3 FCU as a rapid communication and blocklisting system for illicit USDT on TRON. It says the unit has frozen assets within 24 hours, at the request of law enforcement, in account takeover and violent crime emergencies.[5]
- A freeze is not always the end point. In a 2025 US terrorism-financing case, Tether says it froze about $1.6 million in USDT and then reissued it so that US authorities could recover the funds. The announcement does not say which network the USDT was on.[6]
Scams seen on TRON
- TRM Labs reports that address poisoning is common on TRON: scammers send tiny amounts of TRX (often worth less than $0.01) from addresses made to look like ones you have used, hoping you copy the wrong address from your history. TRM says TRON's free bandwidth for basic TRX transfers makes this cheap to do at scale.[7]
- In one case TRM Labs traced, the dust arrived about 18 seconds after a real USDT payment, from an address whose first and last two characters matched the real recipient. Checking only the start and end of an address is not enough. TRM also warns against links placed in TRON memo fields.[7]
- A TRON account does not have to be controlled by one key. Its owner permission can add other keys, change weights and thresholds, and rewrite the account's permissions. Each permission update currently costs 100 TRX on mainnet. This is a legitimate feature, but it is what permission-takeover scams abuse.[8]
Check the history yourself
- TRONSCAN (tronscan.org) is the most widely used TRON block explorer. You can search it by address, transaction ID, contract address or token symbol. Its detail views show timestamps, status, fees and resource use.[9]
- USDT moves on TRON as TRC-20 token transfers, which are recorded as Transfer events of the token contract, not as internal transactions. When you look up a USDT payment, check the token-transfer list for the address, not only its TRX transfers.[10]
Sanctions and enforcement cases
- On 14 August 2025 OFAC designated the exchange Grinex, which Treasury says Garantex staff created to evade sanctions, and listed seven TRON addresses in its entry. The same action added three TRON addresses to Garantex's entry and designated Old Vector, the issuer of the A7A5 token, with one TRON address.[11]
- On 9 September 2026 OFAC designated Xinbi Guarantee, a Chinese-language online marketplace that Treasury says scam centre operators use, and listed 52 TRON addresses in its entry.[12]
- In its October 2025 rule cutting Cambodia-based Huione Group off from the US financial system, FinCEN cited Global Ledger analysis that Huione wallets handled more than $10 billion of USDT on TRON between 1 May and 17 June 2025.[13]
In numbers
- T3 FCU said on 14 May 2026 that it had frozen more than $450 million in illicit assets since launch, and that it intercepted 43.9% more illicit proceeds in 2025 than in 2024.[5]
- By October 2025, T3 FCU said it had supported law enforcement in 23 jurisdictions. The United States accounted for the largest share: $83 million, 27% of volume, across 37 cases.[14]
Common risks on TRON
SanctionsHighAddresses on government sanctions lists or owned by listed entities.ScamHighMoney taken through fake investments, phishing, impersonation and similar deception.Fraudulent exchangeHighExchanges that ran off with user funds or were shut down by authorities.P2P without KYCMediumPeer-to-peer trades where neither side’s identity is checked.Stolen fundsHighCoins taken in hacks of exchanges, protocols or personal wallets.High-risk exchangeMediumExchanges with weak or no customer checks.
FAQ
Why are TRON wallets checked so often?
Because so much USDT moves on TRON, including a large share of illicit stablecoin volume according to TRM Labs. Exchanges screen TRC-20 deposits closely.
Can a TRON address get frozen?
The TRX itself cannot be frozen by an issuer, but USDT on TRON can: Tether can restrict USDT at specific addresses. See the USDT TRC-20 page.
I received a tiny TRX transfer from an address that looks like one I use. What is it?
Probably address poisoning. The sender hopes you will later copy their look-alike address from your history. TRM Labs advises treating unsolicited micro-deposits as suspicious and double-checking the recipient address before every send. Compare the whole address, not just the start and end.
What is the T3 Financial Crime Unit?
A unit set up in September 2024 by Tether, TRON and TRM Labs. It flags USDT on TRON linked to crime and helps law enforcement freeze it.
How do I check a TRON address for AML risk?
Copy the public address, open one of the services listed above that supports TRON, and run the check. You never need a seed phrase or private key.
What does “Not verified” mean?
The service claims support somewhere — in marketing copy or a third-party page — but its own docs, pricing or FAQ do not list the network. Treat it as unknown.
Sources
- Global Ledger — Global Ledger — TRON coverage. Checked 4 Oct 2026.
- TRON developer docs — Account. Checked 4 Nov 2026.
- TRM Labs — Category deep dive: overall 2024 figures and declining illicit crypto volume on TRON. Checked 4 Nov 2026.
- Tether — Tether, TRON and TRM Labs Establish First-Ever Private Sector Financial Crime Unit to Combat Crypto Crime (10 Sept 2024). Checked 4 Nov 2026.
- Tether (issuer's own newsroom) — $450 Million Frozen And Counting: T3 Financial Crime Unit Continues Global Crackdown on Illicit Crypto Flows (14 May 2026). Checked 4 Nov 2026.
- Tether — Tether Acknowledged by U.S. Authorities for Freezing $1.6M Connected to Terrorism Financing (24 Jul 2025). Checked 4 Nov 2026.
- TRM Labs — Understanding Address Poisoning on the TRON Blockchain (22 Oct 2025). Checked 4 Nov 2026.
- TRON developer docs — Account Permission Management (30 Sept 2026). Checked 4 Nov 2026.
- TRON developer docs — TRONSCAN — blockchain explorer and data platform (13 Oct 2026). Checked 4 Nov 2026.
- TRON developer docs — Internal transactions (18 Aug 2026). Checked 4 Nov 2026.
- OFAC, US Treasury — Cyber-related Designations; Russia-related Designations and Designation Updates (Recent Actions, 14 Aug 2025) (14 Aug 2025). Checked 4 Nov 2026.
- OFAC, US Treasury — Transnational Criminal Organizations Designations; Counter Terrorism Designation (Recent Actions, 9 Sep 2026) (9 Sept 2026). Checked 4 Nov 2026.
- FinCEN, US Treasury (Federal Register) — Imposition of Special Measure Regarding Huione Group as a Foreign Financial Institution of Primary Money Laundering Concern (final rule, 90 FR 48295) (16 Oct 2025). Checked 4 Nov 2026.
- Tether (T3 FCU announcement) — T3 Financial Crime Unit Surpasses $300 Million in Frozen Assets, Strengthening Global Efforts Against Crypto-Related Crime (31 Oct 2025). Checked 4 Nov 2026.