Bitquery traces at least $4 million in USDT thefts across TRON address network

Blockchain data firm Bitquery traced at least $4 million in USDT thefts involving a network of 365 TRON addresses. Bitquery published the investigation on November 5, covering activity from October 5 through November 4. The address count includes 89 addresses where only TRX was stolen. The findings add a loss estimate to reporting about iPhone wallet thefts involving zero-click iOS exploits. However, most devices and exploits behind the traced thefts remain unidentified, and Bitquery connected only one counted theft to a published iPhone-owner account.

Bitquery connected 43 collector wallets through funding flows involving a shared wallet that paid transaction fees. The financial connections establish a network but do not prove that a single operator controls the network. In one theft Bitquery identified, a TRONSCAN record shows a transfer of 519,093.330005 USDT to collector TEDjN on October 25. Bitquery calculated the USDT loss total using payments that exhausted the sending address's USDT balance. Bitquery omitted swap payouts, transfers between network addresses and payments from senders that Bitquery could not classify.

Security Alliance separately recorded six reports of compromised iOS wallets, with approximately $127,000 lost between October 28 and November 3. Those reports involved multiple Trust Wallets and one Uniswap Wallet. Device-security research documented wallet-data collection capabilities and completed cryptocurrency theft by the P7 DarkSword spyware variant. On October 21, iVerify and Report URI described how malicious advertisements and expired analytics tags delivered Coruna and DarkSword exploit kits to vulnerable iPhones. iVerify also reported observing a P7 infection delivered through an Instagram advertisement.

Google Threat Intelligence Group documented DarkSword use by multiple actors in research published on March 18. The group recommended iOS updates or Lockdown Mode when updates were unavailable. Trust Wallet repeated the device-security guidance in an advisory on November 6. Trust Wallet urged users to install the newest iOS version supported by the users' devices. Trust Wallet also advised users against keeping recovery phrases and private keys in screenshots or notes.