Kaspersky has warned about a new cryptocurrency scam that turns the promise of “free money” into a trap. According to the cybersecurity firm, fraudsters are posting wallet seed phrases in public spaces such as YouTube comments, pretending to be inexperienced users who do not know how to withdraw funds. The bait is simple but effective: a wallet appears to hold a meaningful amount of USDT, and anyone who imports the seed phrase may believe they have found an easy opportunity to claim abandoned crypto.
What follows, however, is not a lucky discovery but a carefully engineered theft. The scheme is designed to persuade targets to send their own TRX into the wallet under the pretense of covering network fees. Once they do, the funds are redirected to wallets controlled by the scammers, while the USDT remains inaccessible.
How the scam is presented
Kaspersky described a representative example found under a finance-related video. A comment claimed that the poster had USDT in a wallet and possessed the seed phrase, then asked how to move the funds to another wallet. The seed phrase was included directly in the public comment. On its face, the message looked suspicious, because even a beginner would normally understand that sharing a seed phrase publicly is equivalent to giving away access to a wallet.
That suspicion turned out to be justified. Kaspersky said the comment was part of a scam, not a mistake. The public seed phrase is meant to attract opportunistic users who think they can import the wallet and transfer the crypto before anyone else does. In that sense, the fraud relies on temptation just as much as technical trickery.
The role of USDT and the TRX “fee”
After importing the wallet, the target may see what appears to be a balance worth thousands of dollars in USDT. That visual confirmation is what makes the trap convincing. The victim believes the assets are within reach and attempts to transfer them out. At that point, the wallet indicates that a small fee must be paid in TRX, the native token of the TRON network.
Because the wallet does not hold enough TRX to process the transfer, the target is led to believe that sending a relatively small amount from a personal wallet will unlock the much larger USDT balance. This is the emotional pivot of the scam: the victim compares a small upfront cost with a much larger apparent reward and rationalizes the risk.
But according to Kaspersky, once the target sends TRX to the wallet, those tokens do not remain available for fee payment. Instead, they are moved immediately to a different wallet controlled by the attackers. The person trying to claim the USDT loses their TRX, and the promised payout never materializes.
Why the USDT cannot be withdrawn
The key technical element behind the fraud is the use of a multisignature wallet. Kaspersky explained that the bait wallet is configured so that outgoing transfers require approval from two or more parties. As a result, importing the seed phrase and funding the wallet with TRX still does not give the target the ability to move the USDT to a personal address.
This means the visible balance is only there to make the setup believable. It creates the illusion of control without granting actual control. The victim sees the tokens, assumes they can be withdrawn with a small fee payment, and only later discovers that the transaction authorization structure prevents any unilateral transfer.
In practical terms, the scam combines psychological manipulation and wallet configuration. The visible USDT serves as bait, the missing TRX creates urgency, and the multisignature requirement guarantees that the target cannot complete the withdrawal even after sending funds.
A scam that exploits greed and poor security awareness
Kaspersky summarized the social engineering angle bluntly: the fraudsters pretend to be beginners foolish enough to expose access to their wallets, thereby attracting equally naive users who hope to take advantage of the mistake. Those users then become the actual victims.
This makes the scam unusual but effective. It does not begin with a direct phishing page or a fake exchange login. Instead, it weaponizes public curiosity and opportunism. Anyone tempted by the idea of collecting “forgotten” or “abandoned” crypto may walk straight into the trap, especially if they are unfamiliar with how transaction fees and multisignature wallets work.
What users should watch for
Kaspersky’s warning points to several clear red flags. A publicly shared seed phrase should never be treated as a legitimate opportunity. A wallet that appears to contain valuable assets but lacks the token needed for fees is another warning sign. So is any situation in which you are asked, explicitly or implicitly, to fund a wallet you do not own in order to unlock a larger balance.
Users should also understand that seeing assets in a wallet does not automatically mean they can control those assets. Wallet architecture matters. If a wallet requires multiple signatures, no single imported seed phrase can guarantee withdrawal rights. In scams like this, the technical setup is specifically designed to separate what the target can see from what the target can actually move.
The broader takeaway
The case highlighted by Kaspersky is a reminder that crypto fraud is evolving beyond traditional impersonation and fake websites. Scammers are increasingly building traps that rely on partial truths: a real wallet, a real visible balance, and a real need for network fees. What is false is the victim’s assumption that the opportunity is genuine.
For crypto users, the most important defense is simple: do not access or fund wallets that are not yours, no matter how attractive the balance appears. A public seed phrase is not free money. In this scheme, it is the opening move in a theft designed to drain TRX from anyone reckless enough to try claiming the bait.
By staying skeptical, understanding basic wallet mechanics, and refusing to interact with suspicious addresses, users can reduce the risk of becoming the next victim of this “free money” crypto scam.