Blockchain security investigations from Bitquery have traced at least $4 million in USDT thefts across 365 TRON addresses between October 5 and November 4, 2026. The funds were funneled into 43 collector wallets linked by shared transaction-fee funding. Security firms warn that the breaches stem from zero-click iOS exploit kits, such as DarkSword and Coruna, targeting device-level vulnerabilities rather than wallet app flaws. Trust Wallet advises immediate iOS updates.
Bitquery investigation into TRON USDT thefts
- ▪Among the 365 TRON victim addresses traced by Bitquery, 89 addresses experienced TRX-only losses rather than USDT drains
- ▪Bitquery linked 43 collector wallets through funding flows originating from a shared wallet utilized to pay transaction fees
- ▪Bitquery noted that common operator control across the 365 TRON victim addresses and 43 collector wallets remains unproven
- ▪Blockchain data firm Bitquery traced at least $4 million in USDT thefts across 365 TRON victim addresses between October 5, 2026 and November 4, 2026
Bitquery methodology and specific transfer findings
- ▪Bitquery's USDT loss calculation counted payments that emptied an address's USDT balance, while excluding swap payouts, internal network transfers, and unclassified senders
- ▪A TRONSCAN transaction record documented 519,093.330005 USDT moving to a collector wallet designated as TEDjN
- ▪Bitquery's November 5, 2026 investigation linked only one counted theft to a published iPhone-owner account
Trust wallet security warnings and recommendations
- ▪Trust Wallet advised cryptocurrency users to keep wallet recovery phrases and private keys out of screenshots and digital notes
- ▪Trust Wallet issued a security advisory on November 6, 2026 urging iOS users to update to the latest operating system version to mitigate device-level exploits
Exploit kit delivery and spyware capabilities
- ▪iVerify and Report URI reported on October 21, 2026 that malicious advertising and expired analytics tags were used to deliver the Coruna and DarkSword exploit kits to vulnerable iPhones
- ▪Google Threat Intelligence Group reported on March 18, 2026 that the P7 DarkSword spyware variant was deployed by multiple threat actors
- ▪iVerify reported observing a P7 spyware infection delivered through an Instagram advertisement
Story comments
Loading comments…