Two ways a stranger's USDT lands in your wallet

A small amount of USDT arrived from an address you don't recognise. Two known patterns explain it. Dusting is a tiny unsolicited transfer sent to many wallets at once, often with a scam link attached. Address poisoning is a transfer from an address made to look like one you already deal with, so the lookalike sits in your transaction history, ready to be copied by mistake. In both cases, check the token contract first: Tether's official addresses are in the checks below.

A lookalike address that differs only in the middle

Address poisoning relies on people checking the start and end of an address and skipping the middle. Made-up example: a supplier you pay regularly has an address that starts TXy3Fk and ends 9mQ2R. The attacker generates a new address that also starts TXy3Fk and ends 9mQ2R, with every character in between different, and sends you a tiny transfer from it. That address now sits in your wallet's transaction history next to the supplier's real one. The next time you pay the supplier, if you copy the address from your history instead of checking it character by character against the one the supplier gave you, the money goes to the attacker.

Why the deposit adds to your balance instead of sitting apart

USDT on TRON and Ethereum follows the TRC-20 and ERC-20 token standards, which track one balance per address. A transfer adds its amount into that balance. Your wallet then shows a single total that includes whatever just arrived, alongside whatever you already held.

That matters if the sender turns out to be suspicious. Any amount you send out comes from the same total the deposit went into, so you cannot set the stranger's USDT aside and spend only what was yours before. Your own USDT is not locked: you can still send it, but every transfer draws on the combined balance.

Every transfer in or out stays on the public ledger permanently. Tronscan records the sender, recipient, token contract, amount and time of each transfer on TRON, and Etherscan does the same on Ethereum, so anyone who checks the address later, including you, can see where the balance came from. Sending the deposit back or onward does not erase it: it adds one more transaction to the record, and the original transfer stays visible. Moving it quickly gains you nothing, so take the time to check first.

Confirm the contract, then look up the sender

Before you do anything with the deposit, run through these checks in order:

  • Check the token contract your wallet shows against Tether's official addresses: TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t on TRON, 0xdAC17F958D2ee523a2206206994597C13D831ec7 on Ethereum. A different contract means it isn't Tether's USDT, whatever label it carries.
  • Paste the sender's address, or the transaction hash, into Tronscan for a TRON address or Etherscan for an Ethereum address. Both show the sender, recipient, token contract, amount and time for every transfer. Look at what else the sending address has done: a long list of small transfers going out to many different addresses in a short window points to dusting or poisoning, not a payment meant for you.
  • Run the address through TrustSniffer's wallet checker for a second read before deciding anything.
  • If the deposit arrived with a message or a link asking you to visit a site and claim a reward, check that site with the website checker before you connect a wallet or enter any seed phrase there.

Leave the balance alone until the check is clear

If the token contract matches Tether's official address and the sender's history shows no burst of small transfers to many different addresses, a stray deposit isn't a risk to hold. The risk is in what comes with it: a link sent alongside it, or a lookalike address you might copy later. If the contract doesn't match, or the sender does show that pattern, don't click anything that arrived with it. Don't send funds out of that address until you've finished the checks above and know where the deposit came from.

If the sender later turns out to be blacklisted, received USDT from a blacklisted address covers what to save and who to tell. A message that arrives with the deposit and asks for a fee to "release" funds is the scam described in the pay-to-unfreeze USDT scam. You can also look the sender up on the live USDT freeze tracker, which shows whether Tether has moved to freeze that address.

Frequently asked questions

Should I send random USDT back to the address it came from?

There is no need. Returning it leaves the first transfer on Tronscan or Etherscan for good. It also means pasting the stranger's address into your wallet, which is the exact habit address poisoning counts on.

Is it safe to open a link that came with an unexpected USDT deposit?

Treat it as unsafe. A link attached to an unsolicited transfer is how dusting turns into theft. Paste it into the website checker first, which shows our risk assessment, and never connect a wallet or type a seed phrase on a page reached that way.

How do I avoid paying a poisoned lookalike address?

Take the payee's address from the source they gave you or a saved contact, never from your transaction history. Then compare every character, the middle included, because a poisoned address copies only the first and last few.