Zero-click iOS exploits drain $4M USDT from active TRON wallets

Blockchain data firm Bitquery has traced at least $4 million in USDT thefts to a network involving 365 TRON addresses.

Its Nov. 5 investigation adds a loss figure to recent iPhone wallet-theft reporting, while linking just one counted theft to a published iPhone-owner account.

The investigation covers Oct. 5 through Nov. 4, and the 365-address total includes 89 addresses that lost only TRX.

Bitquery linked 43 collector wallets through funding flows to a common wallet used to pay transaction fees. Those financial links establish a network, with common control by a single operator remaining unproven.

In one theft identified by Bitquery, a TRONSCAN transaction record shows 519,093.330005 USDT moving to collector TEDjN on Oct. 25.

For its USDT loss total, Bitquery counted payments that emptied an address's USDT balance. It excluded swap payouts, transfers within the network, and senders it could not classify.

iPhone reports on USDT thefts and current guidance

Security Alliance separately logged six iOS wallet-compromise reports involving approximately $127,000 in losses during Oct. 28 through Nov. 3, across multiple Trust Wallets and one Uniswap Wallet.

Device-security research has documented the broader iPhone threat. P7 DarkSword, a spyware variant, showed wallet-data collection capabilities and completed crypto theft.

On Oct. 21, iVerify and Report URI described malicious advertising and expired analytics tags delivering the Coruna and DarkSword exploit kits to vulnerable iPhones. iVerify also reported an observed P7 infection through an Instagram ad.

Google Threat Intelligence Group's March 18 DarkSword research had already documented use by multiple actors and recommended updating iOS, or enabling Lockdown Mode when updates were unavailable.