The organization behind one of the world’s largest blockchain networks confirmed that TRON’s X account was compromised on May 2, 2025, in a targeted social engineering attack. The breach lasted from 9:25 A.M. PST, when an unauthorized party published a post containing a suspicious contract address. The hacker then proceeded to send direct messages (DMs) to users and follow unknown accounts.
According to TRON’s post-incident analysis, the attacker gained access by targeting a team member with a malicious social engineering scheme. Once inside, the perpetrator used the official account to spread a contract address, potentially luring followers into interacting with a fraudulent smart contract. The attacker also sent unsolicited DMs and followed various accounts, attempting to further exploit the breach even after TRON regained control of the account. TRON DAO promptly warned users:
“TRON DAO will never post contract addresses or send unsolicited DMs. If you received a DM from our account on May 2, please delete it and consider it the work of the attacker.”
The organization has since identified several X and Telegram accounts believed to be associated with the perpetrator and is working with law enforcement to investigate the incident.
TRON founder Justin Sun also called on the OKX exchange to freeze funds linked to the hack, and reposted the TRON official message on X with the simple words:
“Be safe.”
The rise of social engineering threats
Social engineering is responsible for 98% of cyberattacks, and the TRON incident is the latest in a series of high-profile social engineering and phishing attacks in the crypto sector this year. Just days earlier, an elderly American lost $330 million in Bitcoin after being targeted by a sophisticated social engineering scam. In that case, attackers manipulated the victim’s trust and gained access to their wallet, quickly laundering the stolen funds through multiple exchanges and privacy coins.
Another recent case involved the theft of over $40 million in bitcoin from a high-net-worth individual. Hackers used a combination of phishing emails, impersonation, and fake support tickets to bypass even hardware wallet protections.
Advanced social engineering tactics can defeat even the most watertight security measures, and even crypto OGs can fall prey to sophisticated hackers. The breach of TRON’s X account makes it clear that even well-resourced organizations are not immune to the threat.
