A network of 43 collectors, tied to one fee wallet, took at least $4.06M in USDT from 365 TRON wallets. One theft matches an iPhone victim's account to the second

01 · What happenedThe iPhone wallet drains, traced on TRON

On 15 October, a wallet app on an iPhone sent $16,428 to a stranger. It was the wallet's whole balance. Twelve seconds later, its last few coins went the same way. Two more wallet apps on the same phone were emptied too.

The owner described the theft to cpa.rip, a Russian-language affiliate-marketing news site, which published it with other cases in a report on crypto stolen from iPhones. The report says the owner opened a video in Safari, tapped an ad and was sent to another page. It suspects a hacking kit like DarkSword, which can take over an iPhone through a web page.

Other iPhone owners have reported losses since mid-October. On 4 November, a post on X said Trust Wallet users had lost $1.1M. It gave no addresses, and its only source was a Telegram channel.

The stolen money in that first case was USDT, a dollar stablecoin, on TRON. Bitquery reads every transfer on TRON, so we found the theft to the second and followed the money. It led to 43 short-lived collector wallets, all tied to one fee wallet that paid their network fees. Between 5 October and 4 November the collectors took at least $4.06M in USDT from 365 wallets. The ledger shows each theft. It cannot show which phone or app each victim used.

02 · The reportsWhat the DarkSword iOS exploit does

A crypto wallet is only as safe as its seed phrase, the 12 or 24 words that can rebuild it on any device. Whoever has those words has the money. They need no password and no access to the phone.

DarkSword is a kit for hacking iPhones. In March, BleepingComputer reported that the security firm Lookout had found it hidden in hacked websites. SlowMist found that opening a booby-trapped page in Safari is enough to infect a phone. The kit then copies passwords, photos and wallet data. Macworld reported that it searches photos and notes for seed phrases, and that its target list includes Trust Wallet, MetaMask, Phantom and six more wallet apps. SlowMist also describes Coruna, a second exploit chain for older phones on iOS 13 to 17.

Apple has shipped fixes. Its notes for iOS 18.7.7 name DarkSword, and Macworld says phones on iOS 26.3 or later are safe from it. A phone that skipped those updates is still exposed.

We found no statement from Trust Wallet on these thefts. Its name comes up because the kit looks for it and because the posts on X used it. A theft like this also differs from a wallet drainer, a fake site that tricks you into signing away your tokens. Here the thief already holds the keys, as in the LootBot drain.

03 · The trickHow a drain works on TRON

On TRON, sending USDT costs a fee paid in TRX, the chain's own coin, and many people hold plenty of USDT but almost no TRX. So a thief with your seed phrase still needs TRX to move your money.

The thieves pay the fee themselves. The fee wallet, or a collector it has funded, sends the victim's address a few TRX. Seconds later, the whole balance moves to a collector, an address that exists to gather stolen funds. Then the leftover TRX goes too.

Here is one real case, from 25 October. The fee wallet sent 18 TRX to an address in use since September. That address sent more than half a million USDT, all it held, 18 seconds later. Within a minute its TRX had gone to the same collector.

That top-up, followed within seconds by a whole balance leaving, is the pattern we used to find the other victims. Each one led to another collector.

04 · The report's caseMatching the iPhone report to the chain

The cpa.rip report gives times and amounts but no addresses. Its times also run on two clocks, one five hours ahead of UTC and one three hours ahead. Read in UTC, each detail matches one address on TRON.

At 07:29:48 UTC that day, the victim's address sent 16,428 USDT to the collector TNJPXR… in one payment. Twelve seconds later its TRX followed, leaving 0.04 TRX behind. The amount, the gap and what was left all match the report.

The report says the collector already held about $174,000 from sixteen other wallets. On the chain, by 09:51 UTC it held 173,735 USDT, and 16 addresses other than swap pools had sent it USDT or TRX. An hour later it swapped exactly that amount for USDD, another dollar stablecoin on TRON, at the time the report gives for the swap. That evening one more victim sent 10.73 USDT, which is the report's "$10 from yet another stranger".

More than half of the addresses that paid this collector were not victims. Of its 53 senders, 30 were bots that send dust and fake tokens from look-alike addresses, hoping someone will later copy the wrong one. That trick is called address poisoning, and we left them out.

05 · The networkOne fee wallet, 43 collectors

The collector in the report lived for one day. It also sent TRX to TUYFAa…, a fee wallet that led to the rest.

TUYFAa… was created at 16:28 UTC on 5 October. A minute later it got its first money from the Butter Network bridge, so that money came from another chain. From then on it paid fees. It sent TRX to collectors, and to victims just before their money moved.

We found 43 collectors tied to the fee wallet by money. Of those, 39 traded TRX with it directly or emptied a victim it had just paid, and the other four link through another collector or a go-between wallet. Most lived a day or two, took money from a handful of victims and went quiet. Then a new one opened.

A shared fee wallet ties the thefts together. It does not prove one crew ran them all, because hacking kits are sold and rented and one fee wallet could serve several buyers at once. We call the 43 a network because money joins them.

06 · The lossesHow much USDT was stolen

Together the collectors took at least $4.06M in USDT and 137,688 TRX from 365 victim addresses. We count an address only when one payment took all of its USDT, so the real total is higher.

Victims lost money on 27 of the 31 days. The worst day was 25 October, when two of them lost $1.21M between them.

Most victims lost little. Half of the addresses that lost USDT lost less than $1,029. A few large holders carry the total, and the 8 addresses that each lost $100,000 or more make up 63% of it.

The largest single loss came from an address first funded in November 2025. It sent $693K to the collector TUxUus… on 25 October.

07 · The victimsWho lost money

The drained wallets were old and busy. Of them, 46% had held money for more than a year before the theft, and 87% for more than a month. Only 15 were less than a day old.

Most had been used for payments. Of the victims who lost USDT, 78% had paid other addresses before. That rules out a false alarm. Exchanges also top up their own deposit addresses with TRX and sweep them clean, which looks like this pattern. But a deposit address only ever pays its own exchange, and these had paid many others.

Most drained wallets went quiet after the theft. Only 34 of the addresses that lost USDT have moved money since.

An address is not always a separate person. One seed phrase can hold several addresses, and a thief who has the phrase empties them all. Five addresses created within ten minutes of each other in March were emptied within three minutes on 15 October, $144K in all. They most likely had one owner.

08 · The moneyWhere the stolen USDT went

Most collectors swapped the USDT for USDD at the USDD mint, then passed it through go-between wallets that lived for only a few hours before going quiet.

Until 25 October, the main exit was CCE Cash, an exchange that needs no account. Each payment went to a new deposit address, which passed it to the exchange's hot wallet. We traced the money of 12 collectors there.

From 25 October the route changed. The thieves swapped USDD back to USDT and sent it across chains in 33 orders on deBridge, a cross-chain bridge. The orders carried $650K to 8 receiving addresses, on Ethereum for every order but one, which paid out on Optimism. Four collectors also used NEAR Intents, a cross-chain swap service, for another $215K. We followed money through NEAR Intents before, in the NEAR Intents hack.

Some money took a longer path. A shared address, TWUPpT…, lent $1.86M in USDT on JustLend, a TRON lending app. Another address later took the money out and sent $1.90M to a busy one with no label, where we stopped. Not all of that money is shown to be stolen. The smaller exits were OKX, which took $88K in October, and the USDT0 bridge, which moves USDT between chains and carried $153K out in November.

Each exit is a place where the money can be stopped. Tether can freeze USDT, as it did after the CoinDCX hack, and exchanges can hold deposits. Both need a report, fast. Any address in this story can be followed with the Bitquery MCP.

09 · The fee walletWhere the fee wallet got its money

A fee wallet needs money too. We listed every USDT payment into it.

Two of those payments came from exchanges. Within one hour on 18 October, a Bybit hot wallet sent TUYFAa… 571 USDT and a HitBTC hot wallet sent it another 485 USDT. Both are customer withdrawals, so Bybit and HitBTC know which accounts made them. The account holder may be one of the thieves, or someone paying them.

The largest payer, with 9,458 USDT in five payments, is a busy address with no label. The first money, over the Butter Network bridge, came from another chain that we did not trace.

10 · The limitsWhat the chain cannot tell us

The ledger shows money moving. It does not show the phone. We can tie one theft to an iPhone only because that victim published the case. For every other victim in our count, we cannot say which phone, app or hack exposed the seed phrase.

So we cannot say Trust Wallet was hacked. The report's matched case does not name the apps that were drained. If the $1.1M figure is right, those losses could sit inside our count, on other chains, or both.

The cpa.rip report's own latest chart counts 361 TRON wallets, close to our 365. It puts the money taken at $7.88M across 66 collectors. We count only collectors with a money link to the fee wallet, and only payments that emptied an address, so our figure is a floor. Victims on TON, which the report also mentions, are outside our data.

11 · Staying safeIs Trust Wallet safe on an iPhone?

The research on these kits points at the phone. None of it shows a flaw in Trust Wallet or another wallet app. The kits that SlowMist and Macworld describe attack the phone and search it for seed phrases. Any wallet whose seed phrase sits on a hacked phone is exposed.

Update iOS. Apple's fixes are in iOS 18.7.7 and iOS 26.3.

Keep your seed phrase off the phone, which means no photos, notes, screenshots or cloud backups, and write it on paper or a metal plate instead.

Watch for an unknown address sending you a few TRX. For many victims in this network, that gift came seconds before the theft. Address-poisoning bots also send tiny amounts of dust, so a gift of a few whole TRX is the warning sign. If it happens and your USDT is still there, move it at once to a new wallet with a new seed phrase, made on a device you trust.

If you were drained, report it at once to Tether and to any exchange the money reached. Ignore anyone who offers to get it back for a fee. That is a common second scam.

12 · The methodHow we traced the drains

We started from the theft in the cpa.rip report, found it on TRON to the second, and from that collector followed the money forward to the exits and back to every address that paid in. An address joined the network only when money tied it to the fee wallet or to another collector. Exchanges, bridges and swap pools never counted as links, and their names come from Bitquery's own labels.

For each address that paid a collector, we checked its whole USDT history to see whether that one payment took all of it. We read the transfers from Bitquery's TRON data and checked every victim against a second, public source of TRON data. The full TRON history is also sold as files, as the TRON dataset on the Bitquery Data Store. For cases like this, we also run crypto investigation services.

13 · The recordThe addresses behind the drains

FAQ

Was Trust Wallet hacked?

We found no evidence of that. Posts on X claimed $1.1M was drained from Trust Wallet users, without giving an address. Researchers blame iPhone hacking kits that steal seed phrases from the phone, and those kits target many wallet apps. Trust Wallet had made no statement on these thefts that we could find by 5 November.

Is Trust Wallet safe to use on an iPhone?

The risk in these reports sits in the phone. Keep iOS updated, and never store a seed phrase in Photos, Notes or screenshots. A wallet is only as safe as the phone that holds its seed phrase.

What is DarkSword on iOS?

DarkSword is a kit for hacking iPhones through booby-trapped web pages. It copies passwords, photos and wallet data, and searches for seed phrases. Apple's iOS 18.7.7 and iOS 26.3 updates close the holes it uses.

How much USDT was stolen in the iPhone wallet drains?

On TRON alone, we counted at least $4.06M in USDT taken from 365 wallets between 5 October and 4 November, by 43 collectors tied to one fee wallet.

Can stolen USDT be traced to an exchange?

Yes. Every USDT transfer on TRON is public. In this case the money reached CCE Cash, OKX, deBridge and NEAR Intents. The sooner a victim reports it to the exchange and to Tether, the better the chance of a freeze.

Can I get stolen USDT back?

Only if it is frozen before it moves on, which is why speed matters: Tether can freeze USDT on TRON, and exchanges can hold deposits. Ignore anyone who offers to recover crypto for a fee. That is a common second scam.