Bitquery Traces $4.06M USDT Drains Across 365 TRON Wallets
Forty-three collector wallets shared one fee payer from Oct. 5 to Nov. 4. CertiK separately warned unpatched iPhones face DarkSword kit risk.
Blockchain data firm Bitquery says at least $4.06 million in USDT left 365 TRON wallets between Oct. 5 and Nov. 4, routed to 43 short-lived collector addresses that all drew network fees from one common fee wallet.
The firm verified the on-chain figures on Nov. 5. It also counted 137,688 TRX taken from those addresses and at least $103,000 more emptied from 65 wallets on eight other chains, including Ethereum and BNB Chain.
How the drains worked
On TRON, moving USDT costs a fee paid in TRX. Bitquery says the fee wallet first sent a few TRX to a target address, then the whole USDT balance left for a collector within seconds, and leftover TRX followed. That pattern is how investigators linked the collectors. A shared fee wallet ties the money trail together; Bitquery says it does not by itself prove one operator controlled every theft.
Bitquery matched one Oct. 15 case, 16,428 USDT plus TRX 12 seconds later, to a published account from an iPhone owner who said they opened a video in Safari and tapped an ad. For the other addresses, the firm says the chain does not show which phone or wallet app held the seed phrase. It found no evidence of a flaw inside Trust Wallet or other apps; the risk it describes sits in device malware that searches phones for recovery phrases.
Separate DarkSword warning
Separately on Friday, auditor CertiK warned that a newer DarkSword iOS exploit kit is being used against unpatched iPhones, and that opening a malicious site in Safari can be enough. CertiK said the kit can pull Keychain data and search Photos and the Notes app for seed phrases, and listed MetaMask, Trust Wallet, Phantom, Exodus and Coinbase among apps whose on-device data can be targeted. It advised installing the latest iOS update, keeping seed phrases offline, and enabling Lockdown Mode for higher-risk users.
Bitquery's totals are a floor: only full-balance USDT empties tied to the fee wallet are counted. Most devices behind Bitquery's count remain unidentified. Bitquery has not attributed the full $4.06 million total to DarkSword alone.
In our opinion: the next check for holders is the phone OS version and where the seed phrase lives. An updated iOS build and an offline phrase close the door these reports describe.
Sources: Bitquery · The Crypto Times · The Defiant
Revisions
First published .
No revisions since publication.
We fix errors and say so. See every correction on the Blackmint corrections page.