Skip to main content

Security alerts

Security alerts are on for every address you watch, in every scenario, at no cost. They go to every channel that receives the Security group, and the most serious ones never fold into a digest.

Radar reports a change right after it happens on the chain. It can't see a transaction before it's in a block, and it can't stop one. What it gives you is time: you hear about it within seconds instead of when the money is gone.

Permissions changed​

What happened. Someone changed who can sign for the address: an owner or active key was added, removed or re-weighted, or the number of signatures needed changed.

Why it matters. This is the classic TRON wallet takeover. Whoever gets the key once adds their own key as an owner and removes yours, and from then on the address is theirs, whatever you do with your old key.

What the alert shows. How many owner keys there were and how many there are now (Owner keys 1 → 2), whether active permissions changed too, and the transaction. On the address page, the timeline shows the new owner keys and the signatures needed.

What to do.

  1. If you or your team made the change, mark it as reviewed.
  2. If not, act now. Treat the key as compromised: if you still can, move the funds to a new wallet created from a fresh seed phrase, and stop using the old address.
  3. Check the transaction on Tronscan to see which key was added, and check every other address that shares the same seed phrase.

USDT approval​

What happened. The address allowed another address, the spender, usually a contract, to spend its USDT: up to an amount, or without limit.

Why it matters. Phishing sites and fake dApps ask for exactly this. Once the approval is signed, the spender can take the USDT whenever it wants, without asking again. An unlimited approval is the most dangerous kind.

What the alert shows. USDT approval · 1,000.00 USDT or Unlimited USDT approval, and the spender's full address.

What to do. If you didn't mean to approve this spender, revoke the approval now: set its allowance back to zero with your wallet or Tronscan's approval tools, then move the USDT if you can. An approval you gave on purpose, to an exchange or a DeFi app you use, can be marked as reviewed.

USDT frozen by the issuer​

What happened. Tether, the issuer of USDT, froze the USDT on this address. Until it's unfrozen, the address can't send USDT. You also get an alert when it's unfrozen.

What Radar does. It keeps watching the address and sending alerts, but it won't add Energy there: a frozen address can't sweep. The address shows Frozen until the issuer lifts the freeze, even after you mark the alert as reviewed.

What to do. Only the issuer can lift a freeze. Stop sending payments to this address (give your customers another one), and contact the issuer if you believe it's a mistake.

Lookalike address (address poisoning)​

What happened. A transfer to or from this address involved an address made to look like one it deals with: the same first four and last four characters, but a different address.

Why it matters. Scammers create such lookalikes and send your address a tiny or fake-token transfer, so the lookalike appears in your transfer history. They hope that next time you copy the address from your history and pay them instead of your partner.

How Radar spots it. It compares the other side of each transfer, including zero-value and fake-token ones, with the addresses you know: your watched addresses, your address book, and the addresses this one really exchanged USDT or TRX with in the last 30 days. Zero-value and fake-token transfers never show up as deposits.

What the alert shows. Both addresses in full, one under the other, so you can compare them character by character.

What to do. Never copy an address from your transfer history. Use your address book, or an address you've confirmed with the recipient. If your address really paid the lookalike, that payment can't be pulled back: find out where the address was copied from before the next payment. Then mark the alert as reviewed.

How security alerts are delivered​

  • On for every address and every scenario, including Only alert me.
  • Never folded: permission changes, issuer freezes and unlimited USDT approvals always arrive as their own message, even in a busy chat. Limited approvals and lookalike alerts can be part of a digest.
  • Mute 1h in your private chat with the bot silences every Radar alert about that address in that chat, security alerts included. Your other chats and your webhooks still get them.
  • Needs attention: every security alert is listed at the top of the Addresses page until you mark it as reviewed. Reviewing it records that you've seen it; it doesn't change anything on the chain.
  • Webhooks: address.permissions.changed, address.usdt.approval, address.usdt.frozen and address.poisoning.suspected. Their payloads are in Developers.