Zero-Click iOS Attacks Steal $4M in USDT From Active TRON Wallets

The 365-address TRON network lost funds across 89 TRX-only accounts, while a single theft aligned with a published iPhone owner’s report.

Blockchain analytics firm Bitquery linked over $4 million in stolen USDT to an interconnected web of 365 TRON addresses.

Its Nov. 5 investigation attaches a concrete dollar figure to recent iPhone wallet hacks, though only a single documented loss was tied to an owner’s published report.

Spanning Oct. 5 to Nov. 4, the investigation tracked 365 addresses, a total that included 89 wallets stripped strictly of TRX.

Bitquery connected 43 collector wallets by tracing transaction-fee funding back to a central address. While these financial ties confirm a coordinated network, direct control by a single operator remains unproven.

In one theft flagged by Bitquery, a TRONSCAN transaction log reveals that 519,093.330005 USDT was transferred to collector TEDjN on Oct. 25.

To calculate its overall USDT loss, Bitquery logged transactions that completely wiped out an address’s USDT balance. The firm filtered out swap payouts, internal network transfers, and senders that could not be classified.

iPhone Users Report USDT Theft as Security Warnings Emerge#

Security Alliance independently tracked six iOS wallet compromise cases totaling roughly $127,000 in damages between Oct. 28 and Nov. 3, affecting several Trust Wallets and a single Uniswap Wallet.

Device-security researchers have documented the broader threat to iPhones. Most notably, P7 DarkSword—a spyware variant—demonstrated wallet-data scraping capabilities and was caught executing full crypto thefts.

On Oct. 21, iVerify and Report URI exposed how malicious ads and expired analytics tags pushed the Coruna and DarkSword exploit kits onto vulnerable iPhones. Additionally, an active P7 infection was observed by iVerify following a user click on an Instagram ad.

Google’s Threat Intelligence Group had already detailed DarkSword’s deployment across multiple threat actors in its March 18 report. Researchers strongly advised updating iOS, or enabling Lockdown Mode if users were unable to install the latest patch immediately.

Trust Wallet echoed that mobile-security warning in a Nov. 6 advisory. The team strongly urged users to update to the latest iOS build and emphasized that recovery phrases and private keys must be kept out of screenshots and digital notes.