Blockchain analytics firm Bitquery has traced at least $4 million in USDT thefts across a network of 365 TRON addresses, an investigation that adds a blockchain-level perspective to recent reports of iPhone-related cryptocurrency theft.

USDT is a dollar-pegged stablecoin circulating across public blockchains, including TRON, whose open ledger records every transfer and allows analytics firms to reconstruct fund flows after the fact.

The analysis covered on-chain activity between October 5 and November 4. Of the 365 addresses associated with the network, 89 recorded losses involving only TRX, TRON's native token, while the remaining activity was traced to thefts of USDT totaling at least $4 million.

Bitquery also identified financial connections among 43 collector wallets. The firm traced their funding flows to a shared wallet used to cover transaction fees, suggesting that the addresses were connected through common financial infrastructure. The findings, however, do not prove that all of the wallets were controlled by the same individual or operator.

Major USDT Transfer Documented on TRON

One of the transactions identified in the investigation involved 519,093.330005 USDT moving to a collector address identified as TEDjN on October 25. The transfer is documented in a transaction record on TRONSCAN, the TRON network's public block explorer.

How the $4 Million Figure Was Calculated

Bitquery applied specific criteria when calculating the reported USDT losses. Its analysis included payments that completely emptied the USDT balance of an affected address, while excluding swap payouts, transfers between addresses within the identified network, and transactions involving senders that could not be classified. The methodology was intended to distinguish qualifying theft-related outflows from other blockchain movements. The $4 million figure therefore reflects transactions meeting Bitquery's criteria rather than every movement associated with the 365 addresses.

Security Alliance Reports Additional iOS Wallet Compromises

Separate findings from Security Alliance, an industry group focused on cryptocurrency security and incident response, documented six reports of iOS wallet compromises between October 28 and November 3. The incidents involved approximately $127,000 in reported losses across multiple Trust Wallets and one Uniswap Wallet.

Bitquery's investigation adds a broader blockchain perspective to reports of iPhone-related cryptocurrency theft, but the link remains limited: the investigation tied only one of the counted thefts to a publicly documented account from an iPhone owner. The extent of the connection between the wider address network and iOS exploits therefore remains uncertain, leaving an open question for further on-chain analysis and threat-intelligence research.

DarkSword and Coruna Exploits Highlight iPhone Security Risks

Previous security research has documented how sophisticated spyware and exploit kits can compromise vulnerable iPhones and expose cryptocurrency-related information. P7 DarkSword, a spyware variant examined by security researchers, demonstrated capabilities to collect wallet data and carry out cryptocurrency theft. The findings highlight the potential consequences of device compromise for users who store sensitive wallet information on their phones.

On October 21, mobile security firm iVerify and web security service Report URI reported that malicious advertisements and expired analytics tags had been used to deliver the Coruna and DarkSword exploit kits to vulnerable iPhones. iVerify also documented an observed P7 infection associated with an Instagram advertisement.

Google Threat Intelligence Group had previously published research on DarkSword on March 18, documenting its use by multiple threat actors. The organization recommended that users install available iOS updates or activate Lockdown Mode when updating their devices was not possible.

Trust Wallet Urges iPhone Users to Strengthen Device Security

Trust Wallet reinforced those precautions in a November 6 security advisory, encouraging users to install the latest iOS version available for their devices. The wallet provider also warned users against storing recovery phrases and private keys in screenshots or notes, noting that keeping these credentials away from easily accessible files can help reduce exposure if a device is compromised.

Taken together, the findings from Bitquery, Security Alliance, and security researchers highlight the risks facing cryptocurrency users who rely on mobile devices to access their wallets. While the full connection between the identified TRON addresses and iPhone exploits has not been established, the reported thefts underscore the importance of device updates and protecting wallet credentials.

Source: CryptoSlate, via Hokanews. Reporting by Ethan Collins.