Bitquery traces $4.06 million in USDT drained from 365 TRON wallets, and the iPhone exploit link rests on one victim

At least $4.06 million in USDT left 365 TRON wallets between 5 October and 4 November 2026, and the money ended up in 43 collector wallets that all sent fees to the same address, according to an investigation by on-chain data firm Bitquery whose figures were verified on 5 November. The drains also took 137,688 TRX. Bitquery started the trace from a single victim, an iPhone owner who lost 16,428 USDT on 15 October, and its report links the wave to iPhone crypto wallet drains.

What it does not show is how the wallets were emptied. CryptoSlate, which relayed the findings on 7 November, put “zero-click iOS exploits” in its headline. The sources behind the story do not support that word. Only one theft is tied to an iPhone, that victim described tapping an ad in Safari before the loss, and Bitquery itself says it cannot confirm that an exploit kit was used.

The two kits named in the coverage, Coruna and DarkSword, are real. Google, iVerify and wallet makers have documented them, and Apple patched the flaws they rely on months ago. Security firm iVerify calls the ad-borne version a “half-click” attack: the phone is infected when the booby-trapped content loads, not by a message that arrives on its own.

What the kits hunt for on a phone is the recovery phrase, often saved as a photo or a note. Our guide to seed phrase security covers safer ways to keep it.

Bitquery traced $4.06 million in USDT to 43 collector wallets

Bitquery’s method is narrow on purpose. It counted a wallet as a victim only when a single payment emptied all of its USDT, which is the pattern of a drain by someone holding the private key rather than a user making a transfer. The totals are therefore floors. Money taken in several steps, or from wallets that kept a small balance, is not in the count.

The 365 figure counts drained addresses, not people. Of those addresses, 276 lost USDT and 89 lost only TRX. One person can own several addresses, so the number of people hit is not known.

The fee wallet, TUYFAa8hHjeEW6bPqBJ4v3RjQR2uKM1Svk, is the thread that ties the 43 collectors together. Bitquery is careful about what that proves. The links are money flows, and money flows alone do not establish that one person or group controls every collector.

The bridge round trip is the odd part of the route. About $1.51 million came back to TRON from the thieves’ Ethereum addresses through the LI.FI aggregator, in 71 transfers, nearly all paid out as USDT to eight new wallets. Our glossary entry on cross-chain bridges explains how these hops work. Of the $321,000 paid through NEAR Intents into the Ethereum receivers, about $175,000 has no traced source, Bitquery says. Exits from TRON ran through CCE Cash until 25 October, then deBridge, NEAR Intents, OKX ($88,000) and USDT0.

The victims were not small or new accounts. Nearly half of the drained wallets had been in use for more than a year, 87% had held money for over a month, and only 15 were less than a day old. Outside TRON, Bitquery found 65 more wallets drained on eight other chains, mostly Ethereum and BNB Chain, for at least $103,000, with Ethereum ($62,000) and BNB Chain ($24,000) making up most of it. Victims on TON are mentioned but fall outside Bitquery’s data.

A 519,093 USDT drain on 25 October, checked on Tronscan

The heaviest day was 25 October, when about $1.25 million left victims’ wallets, $1.21 million of it from just two of them. The biggest single loss in Bitquery’s data, $693,023, came from a wallet starting TE1Nb7. The second, which Bitquery uses as its case study, is visible on the Tronscan explorer: 519,093.33 USDT from address TJMn77jsqEw7Tu6qgwQiZ6FEwt4H2JcfvB to TEDjNzXWsTrRcHmRnGPPqGRmqCmrA1vvGZ, the largest collector, which received 974,487 USDT in total according to Bitquery.

Coindaro checked that transaction on 7 November through Tronscan’s public API. It is confirmed and marked successful, in Tether’s USDT contract on TRON, in block 87,432,325, at 23:16:39 UTC on 25 October 2026. The sending wallet had made regular USDT payments in the days before. In Tronscan’s records it has sent no USDT since.

One iPhone owner’s report started the investigation

Everything that ties this wave to Apple’s phones goes back to one person. That victim lost 16,428 USDT on 15 October at 07:29:48 UTC, and the wallet’s TRX followed 12 seconds later, leaving 0.04 TRX. Bitquery matched the report to the chain, then followed the collector address outward to find the other wallets.

The victim’s account is specific. The owner reportedly opened a video in Safari, tapped an ad and was sent to another page. The cpa.rip report that Bitquery cites suspects a hacking kit such as DarkSword, a known iPhone exploit chain. Security firm SlowMist, quoted by Bitquery, says opening a booby-trapped page in Safari is enough to infect a vulnerable phone.

Bitquery does not go further. It says it cannot confirm the kit was used in these thefts, and notes that a blockchain ledger does not record which phone, operating system or app a victim used. For the other drained addresses, the public record shows the transfers, not how the thieves got the keys.

Bitquery also cites a report on the cpa.rip site that counts 361 TRON wallets and $7.88 million across 66 collectors. Coindaro could not find that report on the site, so the figure stays unverified.

Why the zero-click label does not fit the evidence

A zero-click attack takes over a phone without any action from its owner, typically through a message or a call the system processes on arrival. If such a flaw were draining crypto wallets on current iPhones, the risk for every holder would be of another order.

That is not what the sources describe. iVerify, in a blog post on malicious ads carrying Coruna and DarkSword, uses the term “half-click”: the phone is infected when the ad content loads, with no need to tap it, but the victim still has to be on a page that shows it. iVerify adds that a fake Polymarket page, one of the places the ads redirected to, could infect a vulnerable phone through the visit alone. CryptoSlate’s own article, beyond its headline, does not confirm a zero-click route either. It says most of the devices and exploits behind the counted thefts remain unidentified, and that only the 15 October theft is matched to an iPhone owner.

The difference matters for what readers do next. A half-click chain needs a malicious page and an unpatched phone. Both can be dealt with. The fake Polymarket page is a separate case from the Polymarket vendor-script drain we reported on 30 October, which went through a third-party script on the real site.

Coruna and DarkSword: two iPhone exploit kits Apple has already patched

Google’s Threat Intelligence Group described DarkSword in a report published on 18 March 2026. The kit targets iOS 18.4 to 18.7, has been active since at least November 2025, and is delivered through websites: a Snapchat-themed decoy site, obfuscated landing pages and compromised Ukrainian sites, each loading the exploit in a hidden frame. It is written entirely in JavaScript. Google tied it to three groups: UNC6748, the Turkish surveillance vendor PARS Defense and UNC6353, a suspected Russian espionage group, and listed “cryptocurrency wallet data” among what it steals.

Google’s report lists six flaws in the chain, with the iOS releases that fixed them:

Google says all six were patched by iOS 26.3, most of them earlier. For older phones, Bitquery notes that Apple’s iOS 18.7.7 release names DarkSword. Apple’s security releases page shows iOS 26.3 shipped on 11 February 2026 and iOS 18.7.7 on 24 March and 1 April, for different models. Apple has since released iOS 27.2, 26.7.2 and 18.7.11, all on 26 October. Coruna is an older chain aimed at iOS 13 to 17, according to SlowMist as quoted by Bitquery.

iVerify lists the wallet apps the implants search for: Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink and Bitpie. The kits can also pull passwords, messages and contacts, and the variants iVerify observed went after keychain secrets. Trust Wallet says they look for recovery phrases saved in photos and notes, a route that needs no flaw in the wallet app itself. iVerify describes attempts to adapt the kits to iOS 26 and 27 as mostly non-functioning.

SEAL logged six iOS wallet thefts in one week, far from the TRON total

A second, independent count comes from the Security Alliance (SEAL), whose weekly figures for 28 October to 3 November show six reports of crypto wallets compromised on iOS, up from four the week before. Losses were about $127,000, against about $434,000 the previous week. Several victims used Trust Wallet, one used Uniswap Wallet, and most were in Russia, Ukraine and Kazakhstan.

SEAL cites the internet-scanning firm Censys as saying DarkSword and Coruna are being used against wallet apps. Its report does not mention TRON, so it supports the existence of iPhone wallet thefts this autumn, not the link between the kits and Bitquery’s $4.06 million.

Trust Wallet: no flaw in the app, Bitquery says

Trust Wallet’s name has circulated on X with a $1.1 million loss figure that no source behind this story confirms. Bitquery found that three of the 71 drained wallets it checked on Ethereum, BNB Chain and Base had turned on Trust Wallet’s EIP-7702 smart-account feature, and one more was linked to MetaMask’s contract. Its conclusion on the app is short: “We found no evidence of a flaw in the Trust Wallet app.” Trust Wallet had made no public statement by 5 November, Bitquery noted.

The company published its own advisory on 6 November. “Apple has already fixed the flaws they use, so devices on the latest iOS version aren’t affected by them,” Trust Wallet wrote of Coruna and DarkSword. It does not list iOS versions or CVE numbers, and it reminds users that it will never ask for their recovery phrase. Anyone who sees unusual activity is asked to contact support with the wallet address and the transaction hash.

What iPhone crypto wallet owners can do now

The steps below come from Google, iVerify, Trust Wallet and Bitquery. None needs a paid service.

1. Update the iPhone to the latest iOS it can run. Google says every DarkSword flaw was fixed by iOS 26.3; older models get iOS 18.7.7 or later. Apple shipped newer builds on 26 October.
2. If the phone cannot be updated, turn on Lockdown Mode, which Google and Trust Wallet both suggest. iVerify recommends it for people who hold large amounts.
3. Keep the recovery phrase out of photos, screenshots, notes and cloud backups. Those are the files the implants search.
4. Stay away from unfamiliar sites and do not tap into unknown ads, the route described by the one known victim.
5. If you think the phone is compromised, move the funds at once to a new wallet with a new recovery phrase, created on a clean device, and check every chain: one phrase opens all of them.
6. iVerify also advises running a scan with its free iVerify Basic app, restarting the phone and changing the passwords stored in the keychain.

Holders with large balances can also keep the keys off the phone entirely. A hardware wallet signs transactions on a separate device, so malware on the iPhone cannot read the recovery words; our step-by-step hardware wallet setup guide covers it.

Can stolen USDT be recovered?

Sometimes, and only if Tether acts before the funds move on. Tether can freeze USDT held at a given address, and it did so for 32 other TRON addresses in late October, as we reported on 29 October. Nothing links that freeze to this case. No source we found shows a freeze, a CVE or an Apple statement tied to the 43 collectors.

Victims can report the theft to Tether and to any exchange the funds reached, with the transaction hashes. Offers of paid “recovery” that appear after a public theft are best ignored.

Open questions: the exploit, the apps and the iOS versions

Which exploit, which wallet apps and which iOS versions were involved in the TRON thefts is unknown. Only one victim is tied to an iPhone. Whether the 43 collectors belong to one group is unproven. The $7.88 million figure attributed to cpa.rip is unverified, TON was not measured, and about $175,000 of NEAR Intents payouts remains untraced.

The next useful facts would come from victims. Each new theft that can be matched to a device and an iOS build would test the iPhone theory one case at a time, and any Tether freeze on the fee wallet or the largest collector would show up on Tronscan the day it happens.