Bitquery traces $4 million USDT theft to 365 TRON addresses

Bitquery has traced at least $4 million in USDT thefts to a network of 365 TRON addresses. An investigation published Nov. 5 analyzed the period from Oct. 5 through Nov. 4, identifying 43 collector wallets linked by funding flows to a common fee-paying wallet.

Network structure and loss methodology

Among the 365 victim addresses, 89 lost only TRX. Bitquery connected the 43 collector wallets via funding flows converging on one wallet for transaction fees, though it noted that common control by a single operator remains unproven.

One TRONSCAN record shows 519,093.330005 USDT moving to a collector address labeled TEDjN on Oct. 25. To calculate total USDT loss, Bitquery counted payments that emptied an address’s balance, excluding swap payouts, internal network transfers, and unclassifiable senders.

iOS security reports and vendor guidance

Security Alliance separately logged six iOS wallet-compromise reports from Oct. 28 through Nov. 3, totaling approximately $127,000 in losses across multiple Trust Wallets and one Uniswap Wallet. While the exploits behind most Bitquery-traced thefts remain unidentified, the findings add a specific loss figure to recent iPhone wallet theft reports.

Research has documented the broader iOS threat landscape. The P7 DarkSword spyware variant can collect wallet data and execute crypto theft. On Oct. 21, iVerify and Report URI detailed how malicious advertising and expired analytics tags delivered Coruna and DarkSword exploit kits to iPhones; iVerify also noted a P7 infection via an Instagram ad.

Google Threat Intelligence Group research from March 18 documented DarkSword’s use by multiple actors, recommending iOS updates or Lockdown Mode. Trust Wallet echoed this in a Nov. 6 advisory, urging users to install the latest iOS version and keep private keys and recovery phrases out of notes and screenshots.

Tether, the stablecoin involved, is up 0.03% over the past 24 hours and ranks #3 by market cap.