Zero-click iOS exploits drain $4M USDT from active TRON wallets

Blockchain data firm Bitquery has traced at least $4 million in USDT thefts to a network involving 365 TRON addresses. The investigation, conducted from Oct. 5 through Nov. 4, revealed that 89 of these addresses lost only TRX tokens, while the remaining losses involved USDT. Bitquery linked 43 collector wallets through funding flows to a common wallet used for transaction fees, establishing a financial network though common operator control remains unproven.

The investigation adds concrete figures to recent reports of iPhone wallet thefts, though only one identified theft matches a published iPhone-owner account. Address counts do not establish a unique victim count, and most devices and exploits behind the thefts remain unidentified. In one specific case traced by Bitquery, a TRONSCAN transaction record shows 519,093.330005 USDT moving to collector TEDjN on Oct. 25.

iPhone security concerns

Security Alliance separately documented six iOS wallet-compromise reports involving approximately $127,000 in losses during Oct. 28 through Nov. 3, affecting multiple Trust Wallets and one Uniswap Wallet. Research has previously documented the broader iPhone threat, with P7 DarkSword spyware showing wallet-data collection capabilities and completing crypto theft.

On Oct. 21, iVerify and Report URI described malicious advertising and expired analytics tags delivering the Coruna and DarkSword exploit kits to vulnerable iPhones. Google Threat Intelligence Group's March research had already documented DarkSword use by multiple actors and recommended updating iOS or enabling Lockdown Mode when updates were unavailable.