Zero-click iOS exploits drain $4M USDT from active TRON wallets

Blockchain data firm Bitquery has traced at least $4 million in USDT thefts to a network involving 365 TRON addresses.

Its Nov. 5 investigation adds a loss figure to recent iPhone wallet-theft reporting, while linking just one counted theft to a published iPhone-owner account.

The investigation covers Oct. 5 through Nov. 4, and the 365-address total includes 89 addresses that lost only TRX.

Bitquery linked 43 collector wallets through funding flows to a common wallet used to pay transaction fees. Those financial links establish a network, with common control by a single operator remaining unproven.

365 addresses and 43 collectors describe a money network, not 365 confirmed iPhone victims.

Address counts do not establish a unique victim count. The USDT aggregate excludes TRX and remains attributed to Bitquery. Most devices and exploits remain unidentified, and common operator control is unproven.

Sources and evidence

Sources

1. Bitquery investigation, figures verified November 5

Supporting facts

• Bitquery reports at least $4.06 million in USDT stolen in a network involving 365 TRON victim addresses between October 5 and November 4, 2026; 89 of those addresses lost only TRX. The address count does not establish the number of unique people affected. [1]
• Bitquery links 43 collector wallets through funding flows to a common fee wallet; those money links do not prove that one operator controlled all of them. [1]
• Bitquery describes TRX fee top-ups followed by USDT drains and matches one October 15 theft to a published iPhone-owner account, but cannot identify the device or exploit for most counted addresses. [1]

Method

Schematic of reported fee funding and drains. Links may be direct or indirect; geometry does not encode values or counts. USDT is valued at $1 in Bitquery's aggregate. No new calculations.

Scope

Address counts do not establish a unique victim count. The USDT aggregate excludes TRX and remains attributed to Bitquery. Most devices and exploits remain unidentified, and common operator control is unproven.

Infographic by CryptoSlate

In one theft identified by Bitquery, a TRONSCAN transaction record shows 519,093.330005 USDT moving to collector TEDjN on Oct. 25.

For its USDT loss total, Bitquery counted payments that emptied an address's USDT balance. It excluded swap payouts, transfers within the network, and senders it could not classify.

iPhone reports on USDT thefts and current guidance

Security Alliance separately logged six iOS wallet-compromise reports involving approximately $127,000 in losses during Oct. 28 through Nov. 3, across multiple Trust Wallets and one Uniswap Wallet.

Device-security research has documented the broader iPhone threat. P7 DarkSword, a spyware variant, showed wallet-data collection capabilities and completed crypto theft.

On Oct. 21, iVerify and Report URI described malicious advertising and expired analytics tags delivering the Coruna and DarkSword exploit kits to vulnerable iPhones. iVerify also reported an observed P7 infection through an Instagram ad.

Google Threat Intelligence Group's March 18 DarkSword research had already documented use by multiple actors and recommended updating iOS, or enabling Lockdown Mode when updates were unavailable.

Trust Wallet reinforced that device-security advice in its Nov. 6 advisory, urging users to install the latest iOS available for their devices and keep recovery phrases and private keys out of screenshots and notes.