The reported TRON account takeover left the attacker in control of the victim’s wallet permissions, while 5,102,539 TRX remained locked in stake as of Oct 13. The account’s owner and active permissions now name the attacker’s key, and the account state still lists both unstake amounts as pending on the victim’s account.

The reported TRON account takeover left the attacker in control of the victim’s wallet permissions, while 5,102,539 TRX remained locked in stake as of Oct 13. The account’s owner and active permissions now name the attacker’s key, and the account state still lists both unstake amounts as pending on the victim’s account.

The report describes a month-long social engineering approach ending in a ClickFix command pasted into the victim’s terminal. At 14:13:24 UTC on Oct 2, the attacker replaced the wallet’s controlling permissions in the takeover transaction. The victim can no longer sign transactions from the account; the attacker controls the account but must wait for the stake to unlock.

The locked TRX is scheduled to become withdrawable in two portions: 555,688 TRX on Oct 16 at 14:16 UTC, then 4,546,851 TRX at 15:13:30 UTC. The account also held about 59.3 liquid TRX in the latest account state. The report’s claim that the attacker could withdraw the unstaked TRX after those times is not evidence that it has since been withdrawn.

The sources do not establish whether either portion was withdrawn after Oct 13.