Community Trust ScoreVerified
Blockchain data firm Bitquery has traced at least $4 million in USDT thefts to a network involving 365 TRON addresses, according to an investigation published on Nov. 5.
The analysis covers transactions from Oct. 5 through Nov. 4. Of the 365 victim addresses identified, 89 lost only TRX, the native token of the TRON network. The remaining addresses experienced the theft of USDT, the stablecoin issued by Tether.
Network of Collector Wallets
Bitquery linked 43 collector wallets to the thefts through funding flows. These wallets were connected to a common address used to pay transaction fees, establishing a financial network. However, the firm noted that common control by a single operator for these 43 wallets remains unproven.
In one specific instance identified in the data, a TRONSCAN transaction record shows 519,093.330005 USDT moving to a collector wallet labeled TEDjN on Oct. 25. For its total loss calculation, Bitquery counted payments that emptied an address’s USDT balance. The firm excluded swap payouts, internal transfers within the network, and senders it could not classify from the final figure.
Device Exploits and User Guidance
While Bitquery’s on-chain analysis quantifies the financial loss, the specific devices and exploits behind most of the traced thefts remain unidentified. The investigation adds a loss figure to recent reporting on iPhone wallet thefts, though it links only one counted theft to a published account of an iPhone owner.
Security Alliance separately logged six iOS wallet-compromise reports between Oct. 28 and Nov. 3. These reports involved approximately $127,000 in losses across multiple Trust Wallets and one Uniswap Wallet. Device-security research has documented the broader threat to iPhones, specifically the P7 DarkSword spyware variant, which demonstrated wallet-data collection capabilities and completed crypto theft.
On Oct. 21, iVerify and Report URI described how malicious advertising and expired analytics tags delivered the Coruna and DarkSword exploit kits to vulnerable iPhones. iVerify also reported an observed P7 infection through an Instagram ad. Earlier research from the Google Threat Intelligence Group, dated March 18, documented DarkSword use by multiple actors and recommended updating iOS or enabling Lockdown Mode when updates were unavailable.
Trust Wallet issued an advisory on Nov. 6 reinforcing this device-security advice. The company urged users to install the latest available iOS for their devices and to keep recovery phrases and private keys out of screenshots and notes.
Tether, the issuer of the stolen USDT, is currently ranked #3 by market cap and is up 0.03% over the past 24 hours.
Frequently Asked Questions
How did Bitquery calculate the $4 million loss?
Bitquery counted payments that emptied an address’s USDT balance. The total excludes swap payouts, transfers within the network, and unclassified senders.
What is the current status of the exploit investigation?
The devices and exploits behind most of the traced thefts remain unidentified. Trust Wallet advises users to update their iOS and protect private keys, as specific malware links for the bulk of the losses are not yet confirmed.
