Bitquery Traces $4 Million USDT Theft Across 365 TRON Addresses Linked to iPhone Exploits
At least $4 million in USDT has been stolen through a network of 365 TRON addresses, according to a November 5 investigation by blockchain data firm Bitquery. The findings add a substantial loss estimate to growing reports of cryptocurrency wallet compromises involving iPhone users, although the available evidence does not establish that every affected address was connected to an iOS exploit.
Bitquery examined blockchain activity between October 5 and November 4, identifying 365 addresses associated with the network. Of those, 89 addresses recorded losses involving TRX only, while the investigation traced the remaining activity to USDT thefts totaling at least $4 million.
The analysis also identified financial connections between 43 collector wallets. Bitquery traced their funding flows to a shared wallet used to cover transaction fees, suggesting that the addresses were connected through a common financial infrastructure. However, the findings do not prove that all wallets were controlled by the same individual or operator.
Bitquery Identifies Major USDT Transfer on TRON
One of the transactions identified in the investigation involved 519,093.330005 USDT moving to a collector address identified as TEDjN on October 25. The transfer is documented in a transaction record on TRONSCAN.
Bitquery applied specific criteria when calculating the reported USDT losses. Its analysis included payments that completely emptied the USDT balance of an affected address, while excluding swap payouts, transfers between addresses within the identified network, and transactions involving senders that could not be classified.
This methodology was intended to distinguish qualifying theft-related outflows from other blockchain movements. The $4 million figure therefore reflects the transactions meeting Bitquery's criteria rather than every movement associated with the 365 addresses.
Security Alliance Reports Additional iOS Wallet Compromises
Separate findings from Security Alliance documented six reports of iOS wallet compromises between October 28 and November 3. The incidents involved approximately $127,000 in reported losses across multiple Trust Wallets and one Uniswap Wallet.
Bitquery's investigation also adds a broader blockchain perspective to reports of iPhone-related cryptocurrency theft. However, the investigation linked only one of the counted thefts to a publicly documented account from an iPhone owner, meaning the extent of the connection between the wider address network and iOS exploits remains uncertain.
DarkSword and Coruna Exploits Highlight iPhone Security Risks
Previous security research has documented how sophisticated spyware and exploit kits can compromise vulnerable iPhones and expose cryptocurrency-related information.
P7 DarkSword, a spyware variant examined by security researchers, demonstrated capabilities to collect wallet data and carry out cryptocurrency theft. The findings highlight the potential consequences of device compromise for users who store sensitive wallet information on their phones.
On October 21, iVerify and Report URI reported that malicious advertisements and expired analytics tags had been used to deliver the Coruna and DarkSword exploit kits to vulnerable iPhones. iVerify also documented an observed P7 infection associated with an Instagram advertisement.
Google Threat Intelligence Group had previously published research on DarkSword on March 18, documenting its use by multiple threat actors. The organization recommended that users install available iOS updates or activate Lockdown Mode when updating their devices was not possible.
Trust Wallet Urges iPhone Users to Strengthen Device Security
Trust Wallet reinforced those precautions in a November 6 security advisory, encouraging users to install the latest iOS version available for their devices.
The wallet provider also warned users against storing recovery phrases and private keys in screenshots or notes. Keeping these credentials away from easily accessible files can help reduce exposure if a device is compromised.
The combined findings from Bitquery, Security Alliance, and security researchers highlight the risks facing cryptocurrency users who rely on mobile devices to access their wallets. While the full connection between the identified TRON addresses and iPhone exploits has not been established, the reported thefts underscore the importance of device updates and protecting wallet credentials.
source: cryptoslate
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.