BUYTRX Exposed: 55 Domains, Zero Auth APIs, and a TRON Approval Drainer Dissected

What Is BUYTRX?

BUYTRX is a TRON-based USDT approval drainer operation disguised as a legitimate cryptocurrency swap service. The sites present professional-looking interfaces that promise to convert USDT to TRX at attractive rates. But the "swap" never happens.

Instead, the victim is prompted to sign an approve(MAX_UINT256) transaction on the USDT (TRC-20) smart contract. This single signature grants the attacker's drainer contract unlimited permission to transfer the victim's entire USDT balance — now and forever — until the approval is manually revoked.

Once the approval is confirmed on-chain, the operator calls transferFrom() to sweep the wallet. The victim sees nothing. No swap. No TRX. Just an empty balance.

The operation has been active since at least July 2025, cycling through dozens of domains as old ones get reported and taken down. The infrastructure adapts faster than most registrars and hosting providers can respond.

55+ Domains — One Operation

Our investigation uncovered a sprawling network of phishing domains, all serving identical or near-identical BUYTRX swap interfaces. The domains span Cloudflare Workers, Cloudflare Pages, and bare-metal origin servers.

Currently Active Domains

Cloudflare Workers & Pages

Origin Servers

An additional 50+ recycled domains were identified, including:

Zero Auth APIs — The Backend Wide Open

The BUYTRX operation runs on 6 Express.js API endpoints sharing a single database. The primary API is hosted at api.trxmo.com. Every single endpoint returns full victim data without any authentication.

Unauthenticated Endpoints

Unauthenticated Admin Dashboard

An admin panel is accessible at /8fb198a6e9b7af32 — a "security by obscurity" hash path with zero authentication. It provides a real-time victim feed showing:

• Wallet addresses of every victim
• Transaction IDs (approval hashes)
• IP addresses of victims
• Timestamps of every interaction
• Approval amounts (typically MAX_UINT256)

{
  "records": [
    {
      "id": 1,
      "wallet": "TKjdnS...redacted",
      "txHash": "a8f3e2...redacted",
      "ip": "185.xxx.xxx.xxx",
      "amount": "115792089237316195423570985008687907853269984665640564039457584007913129639935",
      "status": "approved",
      "createdAt": "2026-02-14T09:23:41.000Z"
    }
  ]
}

Additional vulnerabilities discovered:

• Weak rate limiting: 6 requests per window, trivially bypassed with IP rotation
• Express.js header leak: X-Powered-By: Express reveals server technology
• Potential stored XSS: Admin panel renders unsanitized user-agent strings

On-Chain Evidence

The drainer contracts are deployed on the TRON network and have been actively used to process approval transactions from victims.

4 confirmed on-chain approval transactions were matched to victim records in the exposed database (records 1–10). Records 11–30 appear to be operator test data — test wallets with small amounts, sequential timing patterns, and identical IP ranges.

WalletConnect Integration

The phishing sites use WalletConnect to trigger the approval signing prompt in mobile wallets. The operation uses a single WalletConnect Project ID:

Following the Money — Google Ads & Attribution

Perhaps the most disturbing finding: BUYTRX operators are paying Google to advertise their drainer.

The Google Ads account tracks successful wallet approvals as conversion events. This means Google's advertising platform is literally optimizing ad delivery to find more victims for a crypto drainer — and collecting payment for the service.

The admin dashboard is entirely in Simplified Chinese, with UI elements like 日間 / 夜間 (day/night mode toggles) and source code comments in Chinese. The Telegram handle @buytrx9 serves as the primary operator contact channel.

Takedown Recommendations

This operation touches multiple service providers. Coordinated reporting across all vectors is required:

Evidence & Source Data

Check. Revoke. Report.

If you've interacted with any BUYTRX domain, check your TRON token approvals immediately. Revoke any suspicious approvals and report the domains.

Related Research