Bitquery traces $4M USDT thefts to 365 TRON addresses

Blockchain data firm Bitquery has traced at least $4 million in USDT thefts to a network involving 365 TRON addresses. The investigation, conducted on Nov. 5, covers the period from Oct. 5 through Nov. 4 and adds a specific loss figure to recent reporting on iPhone wallet compromises.

Network structure and funding flows

Bitquery linked 43 collector wallets through funding flows to a common wallet used to pay transaction fees. While these financial links establish a connected network, the firm noted that common control by a single operator remains unproven. Of the 365 TRON victim addresses identified in the network, 89 lost only TRX, the native token of the TRON blockchain.

In one specific instance identified by the investigation, a TRONSCAN transaction record shows 519,093.330005 USDT moving to a collector wallet designated as TEDjN on Oct. 25. For its total USDT loss calculation, Bitquery counted payments that emptied an address’s USDT balance. The firm excluded swap payouts, transfers within the network, and senders it could not classify from the final total.

Device security and wallet guidance

Security Alliance separately logged six iOS wallet-compromise reports involving approximately $127,000 in losses between Oct. 28 and Nov. 3. These reports involved multiple Trust Wallets and one Uniswap Wallet. Device-security research has documented the broader iPhone threat, with P7 DarkSword, a spyware variant, showing wallet-data collection capabilities and completing crypto theft.

On Oct. 21, iVerify and Report URI described malicious advertising and expired analytics tags delivering the Coruna and DarkSword exploit kits to vulnerable iPhones. iVerify also reported an observed P7 infection through an Instagram ad. Google Threat Intelligence Group’s research from March 18 had previously documented DarkSword use by multiple actors and recommended updating iOS or enabling Lockdown Mode when updates were unavailable.

Trust Wallet issued an advisory on Nov. 6, urging users to install the latest available iOS for their devices. The company also advised users to keep recovery phrases and private keys out of screenshots and notes. The devices and specific exploits behind most of the thefts traced by Bitquery remain unidentified. Tether, the stablecoin involved in the traced losses, is currently ranked #3 by market cap and is up 0.02% over the past 24 hours.