Blockchain-data firm Bitquery has traced at least $4.06 million in USDT taken from 365 TRON addresses between October 5 and November 4, 2026. Its investigation connected 43 short-lived collector wallets through funding flows to a common wallet used to pay network fees. Bitquery also identified 65 drained wallets across eight other chains with at least $103,000 in additional losses. The figures describe addresses and transaction paths, not a confirmed count of individual victims or a proven single operator.

What the chain analysis found

Bitquery counted a TRON address as a victim only when one transfer emptied its USDT balance. That conservative rule excluded swap payouts, transfers inside the suspected network and senders the firm could not classify, making the $4.06 million figure a floor rather than a complete loss estimate. The group of 365 addresses included 89 that lost only TRX. Because one seed phrase can control several addresses, the address total cannot be read as 365 separate people.

Related reporting: USDT0 Restores Ethereum–TRON Transfers After Binance-Related Pause

The iPhone evidence is much narrower

The investigation matched one October 15 drain to a published account from an iPhone owner: 16,428 USDT left the address, followed 12 seconds later by its remaining TRX. For the other counted addresses, the blockchain does not reveal the phone, wallet application or exploit involved. Reports about the Coruna and DarkSword exploit kits provide relevant device-security context, but they do not prove that those tools caused every transfer in Bitquery's dataset.

How the TRON drain pattern worked

Many TRON users hold USDT but little TRX, which is needed to pay transaction fees. Bitquery observed the suspected fee wallet or a connected collector sending small amounts of TRX to a target address. Seconds later, the address's full USDT balance moved to a collector and the remaining TRX often followed. The firm used that sequence, together with funding links and full-balance withdrawals, to identify the 43 collectors and their victim addresses.

Funds crossed chains and returned

Bitquery said some collectors converted USDT to USDD before moving proceeds through short-lived intermediary wallets. From October 25, it traced about $650,000 through deBridge and another $215,000 through NEAR Intents. Eight receiving addresses on Ethereum later sent $1.51 million through LI.FI in 71 transfers that paid out on TRON. These paths show cross-chain movement, but wallet links alone do not establish who controlled each address or whether every payment represented stolen funds.

No wallet-app breach has been established

CryptoSlate's independent review emphasized that most victim devices remain unidentified. Bitquery likewise said its evidence does not show a flaw in Trust Wallet or another wallet application. Security Alliance separately recorded six recent iOS wallet-compromise reports, but those reports cover a much smaller loss set and do not attribute Bitquery's entire TRON network. A shared fee source can connect transactions without proving that one actor, exploit seller or customer ran every collection wallet.

Current security guidance

Trust Wallet published an advisory on November 6 and updated it November 7, urging iPhone users to install the latest iOS version available for their devices. It said users who cannot update immediately should consider Lockdown Mode and should not store recovery phrases or private keys in screenshots, photos or notes. The company said Apple has fixed the vulnerabilities used by the cited Coruna and DarkSword kits, while devices missing those updates can remain exposed.

What investigators still need to establish

The next questions are whether exchanges can identify accounts that funded the fee wallet, whether stablecoin issuers or trading venues can freeze traced proceeds, and whether device forensics can connect more victims to a specific exploit. Bitquery's work supplies a transaction map and minimum loss estimate. It does not identify the thieves, prove common control of every collector or establish that iOS compromise explains the full network. Those limits matter when turning on-chain patterns into security or legal conclusions.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.