Blockchain data firm Bitquery has traced at least $4 million in USDT thefts across 365 TRON addresses. The firm’s Nov. 5 report covers Oct. 5 through Nov. 4 and puts a loss figure on a set of wallet compromises that have been discussed alongside recent iPhone wallet theft reports. The 365-address count includes 89 addresses that lost only TRX, so the USDT total is not the same as every affected wallet.
How the wallets connect
Bitquery linked 43 collector wallets through funding flows to a common wallet used to pay transaction fees. That pattern points to a network, the firm says, though common control by one operator is not proven. The financial links are evidence, but they do not by themselves identify who is behind the transfers. One theft in the data shows 519,093.330005 USDT moving to collector TEDjN on Oct. 25, according to a TRONSCAN record cited by Bitquery.
For the $4 million USDT figure, Bitquery counted payments that emptied an address’s USDT balance. It left out swap payouts, transfers inside the network, and senders it could not classify. That method matters because a broad loss estimate can change depending on what is counted. The report does not claim every theft is tied to the same attack method.
iPhone reports add context
Security Alliance separately logged six iOS wallet-compromise reports between Oct. 28 and Nov. 3. Those reports involve about $127,000 in losses across several Trust Wallets and one Uniswap Wallet. The cases add context to the TRON data, but the two sets of figures should not be merged without care. One report from Bitquery was linked to a published iPhone-owner account; the rest are not laid out that way.
Device-security research has documented the wider iPhone threat. P7 DarkSword, a spyware variant, showed wallet-data collection capabilities and completed crypto theft. On Oct. 21, iVerify and Report URI described malicious advertising and expired analytics tags delivering the Coruna and DarkSword exploit kits to vulnerable iPhones. iVerify also reported an observed P7 infection through an Instagram ad.
Google Threat Intelligence Group’s March 18 DarkSword research had already documented use by multiple actors. Its advice was to update iOS or enable Lockdown Mode when updates were unavailable. Trust Wallet repeated that device-security advice in a Nov. 6 advisory, telling users to install the latest iOS available for their devices and keep recovery phrases and private keys out of screenshots and notes.
The post Bitquery Ties $4M USDT Theft to 365 TRON Addresses appeared first on TheCryptoUpdates .
