CryptoSlate
Blockchain data firm Bitquery traced at least $4M in USDT thefts to a network involving 365 TRON addresses. Its Nov. 5 investigation, covering Oct. 5 through Nov. 4, linked 43 collector wallets through funding flows to a common wallet used to pay transaction fees. One identified theft moved 519,093.330005 USDT on Oct. 25, while 89 of the 365 victim addresses lost only TRX.
Why it matters
Those funding links establish a collector network, although common control by a single operator remains unproven. Bitquery counted payments that emptied addresses' USDT balances and excluded swap payouts, internal transfers and unclassified senders, so $4M represents traced direct theft rather than every possible loss.
The wider iPhone risk is documented. Security Alliance logged six iOS wallet-compromise reports involving about $127,000 from Oct. 28 through Nov. 3, across multiple Trust Wallets and one Uniswap Wallet. Researchers linked malicious advertising and expired analytics tags to delivery of the Coruna and DarkSword exploit kits. P7 DarkSword spyware can collect wallet data and has completed crypto theft. Only one counted theft was linked to a published iPhone-owner account, and the devices and exploits behind most traced losses remain unidentified.
Market impact
The evidence points to compromised devices and collection infrastructure, not a demonstrated failure of the TRON or USDT protocols. Even so, zero-click exploits can drain USDT and TRX from active wallets, leaving holders exposed while the exploit chain remains unresolved.
Trust Wallet's Nov. 6 advisory urged users to install the latest iOS available and keep recovery phrases and private keys out of screenshots and notes. Google Threat Intelligence Group also recommended Lockdown Mode when updates were unavailable. The key watchpoint is whether updated software and identification of the exploits slow the losses.
Frequently asked questions
-
How did Bitquery link the 43 collector wallets together?
Bitquery linked them through funding flows to a common wallet used to pay transaction fees. The links establish a network, but they do not prove that one operator controls every collector wallet.
-
What did the 365 TRON victim addresses represent?
They were addresses identified in Bitquery's investigation, which covered Oct. 5 through Nov. 4. The total included 89 addresses that lost only TRX, while the $4M figure counted payments that emptied USDT balances.
-
Which iOS threats were linked to the wallet compromises?
Researchers linked malicious advertising and expired analytics tags to delivery of the Coruna and DarkSword exploit kits. P7 DarkSword spyware was also documented as capable of collecting wallet data and completing crypto theft.
-
What action did Trust Wallet recommend to iPhone users?
Trust Wallet urged users to install the latest available iOS updates and keep recovery phrases and private keys out of screenshots and notes. It also reinforced device-security advice after separate iPhone compromise reports.
-
Were the devices and exploits behind the traced thefts identified?
No. Bitquery linked only one counted theft to a published iPhone-owner account, and the devices and exploits behind most of the traced thefts remained unidentified.
WuBlockchain
WatcherGuru
CoinTelegraph
TheBlock
Lookonchain