Blockchain data firm Bitquery has traced at least $4 million in USDT thefts to a network involving 365 TRON addresses, according to a Nov. 5 investigation. The findings add a loss figure to recent reports of iPhone wallet thefts, but link just one counted theft to a published iPhone-owner account.
The investigation covers the period from Oct. 5 through Nov. 4. Of the 365 TRON victim addresses, 89 lost only TRX, which is excluded from the USDT total. Bitquery linked 43 collector wallets through funding flows to a common wallet used to pay transaction fees. Those financial links establish a network, though common control by a single operator remains unproven.
Bitquery emphasized that the 365 addresses and 43 collectors describe a money network, not 365 confirmed iPhone victims. Address counts do not establish a unique victim count, and the USDT aggregate remains attributed to Bitquery. Most devices and exploits behind the traced thefts remain unidentified.
In one theft identified by Bitquery, a TRONSCAN transaction record shows 519,093.330005 USDT moving to collector TEDjN on Oct. 25. For its USDT loss total, Bitquery counted payments that emptied an address's USDT balance, excluding swap payouts, transfers within the network, and senders it could not classify.
Separate reports and device-security research
Security Alliance separately logged six iOS wallet-compromise reports involving approximately $127,000 in losses during Oct. 28 through Nov. 3, across multiple Trust Wallets and one Uniswap Wallet.
Device-security research has documented the broader iPhone threat. P7 DarkSword, a spyware variant, showed wallet-data collection capabilities and completed crypto theft. On Oct. 21, iVerify and Report URI described malicious advertising and expired analytics tags delivering the Coruna and DarkSword exploit kits to vulnerable iPhones. iVerify also reported an observed P7 infection through an Instagram ad.
Google Threat Intelligence Group's March 18 DarkSword research had already documented use by multiple actors and recommended updating iOS, or enabling Lockdown Mode when updates were unavailable.
Trust Wallet reinforced that device-security advice in its Nov. 6 advisory, urging users to install the latest iOS available for their devices and keep recovery phrases and private keys out of screenshots and notes.
