A single crew took at least $4.06M in USDT from 365 TRON wallets and drained 65 more on eight other chains. One theft matches an iPhone owner's write-up to the second
A month of crypto thefts reported from iPhones left a trail on TRON. We followed it from one victim's account to every wallet drained the same way, across nine chains, and on to where the money went.
- $4.06M
- 65
- 12 seconds
- 46%
- $1.51M
- 18 Oct
01 · What happenedThe iPhone wallet drains, traced on TRON
On 15 October, a wallet app on an iPhone sent $16,428 to a stranger. It was the wallet's whole balance. Twelve seconds later, its last few coins went the same way. Two more wallet apps on the same phone were emptied too.
The owner told the story to cpa.rip, a Russian-language affiliate-marketing news site. The site put it in a report on crypto stolen from iPhones, with other cases. The report says the owner opened a video in Safari, tapped an ad and was sent to another page. It suspects a hacking kit like DarkSword, which can take over an iPhone through a web page.
Other iPhone owners have reported losses since mid-October. On 4 November, a post on X said Trust Wallet users had lost $1.1M. It gave no addresses, and its only source was a Telegram channel.
The stolen money in that first case was USDT, a dollar stablecoin, on TRON. Bitquery reads every transfer on TRON, so we found the theft to the second and followed the money. It led to 43 short-lived collector wallets, all tied to one fee wallet that paid their network fees. Between 5 October and 4 November the collectors took at least $4.06M in USDT from 365 wallets. The same thieves also emptied wallets on eight other chains, and the money they bridged to Ethereum came straight back to TRON. The ledger shows each theft. It rarely shows which phone or app a victim used.
02 · The reportsWhat the DarkSword iOS exploit does
A crypto wallet is only as safe as its seed phrase, the 12 or 24 words that can rebuild it on any device. Whoever has those words has the money. They need no password and no access to the phone.
DarkSword is a kit for hacking iPhones. In March, BleepingComputer reported that the security firm Lookout had found it hidden in hacked websites. SlowMist found that opening a booby-trapped page in Safari is enough to infect a phone. The kit then copies passwords, photos and wallet data. Macworld reported that it searches photos and notes for seed phrases. Its target list includes Trust Wallet, MetaMask, Phantom and six more wallet apps. SlowMist also describes Coruna, a second exploit chain for older phones on iOS 13 to 17.
Apple has shipped fixes. Its notes for iOS 18.7.7 name DarkSword, and Macworld says phones on iOS 26.3 or later are safe from it. A phone that skipped those updates is still exposed.
Trust Wallet has said nothing about these thefts. Its name comes up because the kit looks for it and because victims say they used it. SEAL, a security alliance that collects victim reports, logged six iPhone wallet thefts in the week to 3 November, worth about $127K. Several were Trust Wallet users and one used Uniswap Wallet. In October, Censys, a security firm, found a copy of the kit on an open server. It had a part built for Trust Wallet, among many others.
A theft like this differs from a wallet drainer, a fake site that tricks you into signing away your tokens. Here the thief already holds the keys, as in the LootBot drain.
03 · The trickHow a drain works on TRON
On TRON, sending USDT costs a fee paid in TRX, the chain's own coin, and many people hold plenty of USDT but almost no TRX. So a thief with your seed phrase still needs TRX to move your money.
The thieves pay the fee themselves. The fee wallet, or a collector it has funded, sends the victim's address a few TRX. Seconds later, the whole balance moves to a collector, an address that exists to gather stolen funds. Then the leftover TRX goes too.
Here is one real case, from 25 October. The fee wallet sent 18 TRX to an address in use since September. That address sent more than half a million USDT, all it held, 18 seconds later. Within a minute its TRX had gone to the same collector.
That top-up, followed within seconds by a whole balance leaving, is the pattern we used to find the other victims. Each one led to another collector.
04 · The report's caseMatching the iPhone report to the chain
The cpa.rip report gives times and amounts but no addresses. Its times also run on two clocks, one five hours ahead of UTC and one three hours ahead. Read in UTC, each detail matches one address on TRON.
At 07:29:48 UTC that day, the victim's address sent 16,428 USDT to the collector TNJPXR… in one payment. Twelve seconds later its TRX followed, leaving 0.04 TRX behind. The amount, the gap and what was left all match the report.
The report says the collector already held about $174,000 from sixteen other wallets. On the chain, by 09:51 UTC it held 173,735 USDT, and 16 addresses other than swap pools had sent it USDT or TRX. An hour later it swapped exactly that amount for USDD, another dollar stablecoin on TRON, at the time the report gives for the swap. That evening one more victim sent 10.73 USDT, which is the report's "$10 from yet another stranger".
More than half of the addresses that paid this collector were not victims. Of its 53 senders, 30 were bots that send dust and fake tokens from look-alike addresses, hoping someone will later copy the wrong one. That trick is called address poisoning, and we left them out.
05 · The networkOne fee wallet, 43 collectors
The collector in the report lived for one day. It also sent TRX to TUYFAa…, a fee wallet that led to the rest.
TUYFAa… got its first money at 16:29 UTC on 5 October, over the Butter Network bridge, so that money came from another chain. A collector sent it 20 TRX 19 minutes later, which made it a live account on TRON. From then on it paid fees. It sent TRX to collectors, and to victims just before their money moved.
We found 43 collectors tied to the fee wallet by money. Of those, 39 traded TRX with it directly or emptied a victim it had just paid, and the other four link through another collector or a go-between wallet. Most lived a day or two, took money from a handful of victims and went quiet. Then a new one opened.
A shared fee wallet ties the thefts together. It does not prove one crew ran them all, because hacking kits are sold and rented and one fee wallet could serve several buyers at once. We call the 43 a network because money joins them.
06 · The lossesHow much USDT was stolen
Together the collectors took at least $4.06M in USDT and 137,688 TRX from 365 victim addresses. We count an address only when one payment took all of its USDT, so the real total is higher.
Victims lost money on 27 of the 31 days. The worst day was 25 October, when two of them lost $1.21M between them.
Most victims lost little. Half of the addresses that lost USDT lost less than $1,029. A few large holders carry the total, and the 8 addresses that each lost $100,000 or more make up 63% of it.
The largest single loss came from an address first funded in November 2025. It sent $693K to the collector TUxUus… on 25 October.
07 · The victimsWho lost money
The drained wallets were old and busy. Of them, 46% had held money for more than a year before the theft, and 87% for more than a month. Only 15 were less than a day old.
Most had been used for payments. Of the victims who lost USDT, 78% had paid other addresses before. That rules out a false alarm. Exchanges also top up their own deposit addresses with TRX and sweep them clean, which looks like this pattern. But a deposit address only ever pays its own exchange, and these had paid many others.
Most drained wallets went quiet after the theft. Only 34 of the addresses that lost USDT have moved money since.
An address is not always a separate person. One seed phrase can hold several addresses, and a thief who has the phrase empties them all. Five addresses created within ten minutes of each other in March were emptied within three minutes on 15 October, $144K in all. They most likely had one owner.
08 · The moneyWhere the stolen USDT went
Most collectors swapped the USDT for USDD at the USDD mint, then passed it through go-between wallets that lived for only a few hours before going quiet.
Until 25 October, the main exit was CCE Cash, an exchange that needs no account. Each payment went to a new deposit address, which passed it to the exchange's hot wallet. We traced the money of 12 collectors there.
From 25 October the route changed. The thieves swapped USDD back to USDT and sent it across chains in 33 orders on deBridge, a cross-chain bridge. The orders carried $650K to 8 receiving addresses, on Ethereum for every order but one, which paid out on Optimism. Four collectors also used NEAR Intents, a cross-chain swap service, for another $215K. We followed money through NEAR Intents before, in the NEAR Intents hack.
Some money took a longer path. A shared address, TWUPpT…, lent $1.86M in USDT on JustLend, a TRON lending app. Another address later took the money out and sent $1.90M to a busy one with no label, where we stopped. Not all of that money is shown to be stolen. The smaller exits were OKX, which took $88K in October, and the USDT0 bridge, which moves USDT between chains and carried $153K out in November.
Each exit is a place where the money can be stopped. Tether can freeze USDT, as it did after the CoinDCX hack, and exchanges can hold deposits. Both need a report, fast. Any address in this story can be followed with the Bitquery MCP.
09 · The round tripThe money went back to TRON
We followed the 8 receiving addresses on Ethereum too. Over the next ten days they sent $1.51M through LI.FI, an app that routes money across chains. All 71 of those transfers paid out on TRON again, almost all as USDT, to 8 new wallets. Another $62K went back the same way over the USDT0 bridge.
Why go to Ethereum at all? It breaks the trail. Anyone who watches only one chain loses the money when it leaves, and may not see it come back.
Back on TRON, the money moved on to 13 more wallets. Two of them are large wallets that moved $9.6M and $7.3M since late October. This network supplied only two or three cents of every dollar they took in, so we stopped there and do not name them.
10 · Other chainsThe same thieves on eight more chains
A seed phrase opens a wallet on every chain it uses. So we checked the thieves' own wallets beyond TRON. The ones that paid the Ethereum receivers use the same addresses on six other chains, from BNB Chain to Avalanche, since one key gives the same address on all of them.
On each chain we listed the wallets that paid them, and we kept only the ones that were emptied and never used again. In all, 65 wallets pass, on eight chains besides TRON. Together they lost at least $103K in coins and stablecoins, most of it in the last week of October, when the thieves were busy on TRON as well.
Ethereum and BNB Chain carry most of it. On BNB Chain, 24 drained wallets had nothing taken on Ethereum, so each chain adds victims of its own.
Nineteen of them lost money on more than one chain. One wallet, in use for two and a half years, was emptied on six chains in 17 minutes on 28 October. The thieves sold its tokens inside the wallet, sent it a little money for fees and then took the coins, the same trick they used on TRON.
Small chains feed the big ones. A wallet on Base lost 6.32 ETH, and less than an hour later Relay, a service that moves money between chains, brought almost all of it to the thieves' wallet on Ethereum.
Solana is part of the same network. The TRON fee wallet's first money left a Solana wallet three minutes before it reached TRON. Later the thieves emptied another Solana wallet, in use for over two years. Its coins went through Relay to one of their wallets on Ethereum.
11 · The fee walletWhere the fee wallet got its money
A fee wallet needs money too. We listed every USDT payment into it.
Two of those payments came from exchanges. Within one hour on 18 October, a Bybit hot wallet sent TUYFAa… 571 USDT and a HitBTC hot wallet sent it another 485 USDT. Both are customer withdrawals, so Bybit and HitBTC know which accounts made them. The account holder may be one of the thieves, or someone paying them.
The largest payer, with 9,458 USDT in five payments, is a busy address with no label. The first money came over the Butter Network bridge from a Solana wallet. A new wallet had paid that one a minute before.
12 · The limitsWhat the chain cannot tell us
The ledger shows money moving. It does not show the phone. We can tie one theft to an iPhone only because that victim published the case. For every other victim in our count, we cannot say which phone or hack exposed the seed phrase.
So we cannot say Trust Wallet was hacked. The report's matched case does not name the apps that were drained. SEAL's reports and the kit Censys found both point at Trust Wallet, along with other apps. Neither shows a flaw in the app itself.
We did find one clue about the app. Of the 71 drained wallets we checked on Ethereum, BNB Chain and Base, three had switched on a smart-account feature, called EIP-7702, that links a wallet to a contract. Our labels mark that contract as Trust Wallet's, and its own code names it so. One of those owners had used it for gas-free USDT payments for two months before the theft. One more drained wallet links to MetaMask's contract. So at least some victims used Trust Wallet, but a handful of wallets cannot tell us which app most of them used.
The cpa.rip report's own latest chart counts 361 TRON wallets, close to our 365. It puts the money taken at $7.88M across 66 collectors. We count only collectors with a money link to the fee wallet, and only payments that emptied an address, so our figure is a floor. Victims on TON, which the report also mentions, are outside our data.
13 · Staying safeIs Trust Wallet safe on an iPhone?
The research on these kits points at the phone. None of it shows a flaw in Trust Wallet or another wallet app. The kits that SlowMist, Macworld and Censys describe attack the phone and search it for seed phrases. Any wallet whose seed phrase sits on a hacked phone is exposed.
Update iOS. Apple's fixes are in iOS 18.7.7 and iOS 26.3.
Keep your seed phrase off the phone, which means no photos, notes, screenshots or cloud backups, and write it on paper or a metal plate instead.
Watch for an unknown address sending you a few TRX, or a tiny amount of ETH or BNB on other chains. For many victims in this network, that gift came seconds before the theft. Address-poisoning bots also send tiny amounts of dust, so a gift of a few whole TRX is the warning sign on TRON. If it happens and your money is still there, move it at once to a new wallet with a new seed phrase, made on a device you trust.
A stolen seed phrase opens every chain at once. If money leaves one chain without you signing, move what is left on all the others too. Do it fast.
If you were drained, report it at once to Tether and to any exchange the money reached. Ignore anyone who offers to get it back for a fee. That is a common second scam.
14 · The methodHow we traced the drains
We started from the theft in the cpa.rip report and found it on TRON to the second. From that collector we followed the money forward to the exits, and back to every address that paid in. An address joined the network only when money tied it to the fee wallet or to another collector. Exchanges, bridges and swap pools never counted as links, and their names come from Bitquery's own labels.
For each address that paid a collector, we checked its whole USDT history to see whether that one payment took all of it. We read the transfers from Bitquery's TRON data and checked every victim against a second, public source of TRON data. The full TRON history is also sold as files, as the TRON dataset on the Bitquery Data Store. For cases like this, we also run crypto investigation services.
On other chains we began with the thieves' own wallets and listed every wallet that paid them. Bitquery's data gave us those transfers, and it is also sold as files for Ethereum and BNB Chain. We checked each victim's balance today on a public node. Where money crossed a bridge, the bridge's own records showed the other side.
Transfers were read up to the morning of 5 November 2026 (UTC). Anything later is not covered.
A wallet counts as a victim only when one payment to a collector took all of its USDT. Wallets that kept a little are left out, so the totals are a floor. One wallet that sent a collector 52,263 USDT and kept less than 1 USDT is not counted.
Not counted: 221,690 USDT paid into collectors by the Bridgers bridge, whose origin we could not see, and 198,508 USDT that 11 more wallets in the network passed in. Those wallets' own senders were not tested.
Of the victims, 89 lost only TRX. They count when their balance now is under 1 TRX, nothing is staked, and they signed nothing after the drain.
Three collectors have a weaker money link to the fee wallet. Their 24 victims lost 530,131 USDT, which is inside the total.
The TRX total is a floor. One more wallet in the network, outside the 43, took leftover TRX from five victims, and one victim lost another 43,009 TRX after the drain. Neither is counted.
USDT is counted at $1. TRX is not priced. On other chains, coins are priced at the Binance close on 25 October and stablecoins at $1. Tokens the thieves sold inside victims' wallets are not priced, and thefts on TON are not measured.
Victims on other chains were found only through the thieves' wallets that paid the Ethereum receivers. One more Ethereum wallet looks like a further collector, and a second check found about 60 drained wallets behind it. We have not confirmed that link yet, so none of them is counted.
NEAR Intents paid $321K into the Ethereum receivers. About $175K of that matches no deposit we traced from TRON, so its source is open.
A separate TRON collector took money from about 100 wallets in one batch on 3 November. We found no money link between it and this network, so it is not counted.
Links between wallets are money links. They do not prove that one person controls them. A ledger never records the phone, and only rarely the wallet app.
Correction, 5 November: we first wrote that the fee wallet was made a minute before its first money came in. In fact the money came first. The wallet went live 19 minutes later.
15 · The recordThe addresses behind the drains
Follow a drained wallet's USDT in plain English
Every transfer in this story comes from Bitquery's TRON data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's USDT went, or which wallets paid a collector, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the TRON dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any wallet, phone, exchange, bridge, protocol or service.
The findings describe transactions and balances observed on TRON, Ethereum, BNB Chain, Base, Arbitrum, Optimism, Polygon, Avalanche and Solana between 5 October and 5 November 2026. Attributions come from on-chain behaviour and Bitquery's own labels; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Apple, Trust Wallet, MetaMask, CCE Cash, deBridge, NEAR Intents, LI.FI, Relay, USDT0, JustLend, OKX, Bybit, HitBTC, Butter Network, Bridgers, USDD, cpa.rip, Macworld, SlowMist, SEAL, Censys or any other named project, company or service describe what the public record shows and what those parties have said in public. They are not statements about any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently or knew of the thefts. Victims are identified by wallet address only. The wallets that took the funds are described by their behaviour and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Was Trust Wallet hacked?
We found no evidence of a flaw in the Trust Wallet app. Posts on X claimed $1.1M was drained from Trust Wallet users, without giving an address. SEAL's victim reports list several Trust Wallet users among recent iPhone thefts, and researchers blame iPhone hacking kits that steal seed phrases from the phone. Those kits target many wallet apps. On Ethereum and BNB Chain, three drained wallets had used Trust Wallet's smart-account feature before the theft. Trust Wallet had made no statement on these thefts that we could find by 5 November.
Is Trust Wallet safe to use on an iPhone?
The risk in these reports sits in the phone. Keep iOS updated, and never store a seed phrase in Photos, Notes or screenshots. A wallet is only as safe as the phone that holds its seed phrase.
What is DarkSword on iOS?
DarkSword is a kit for hacking iPhones through booby-trapped web pages. It copies passwords, photos and wallet data, and searches for seed phrases. Apple's iOS 18.7.7 and iOS 26.3 updates close the holes it uses.
How much USDT was stolen in the iPhone wallet drains?
On TRON alone, we counted at least $4.06M in USDT taken from 365 wallets between 5 October and 4 November, by 43 collectors tied to one fee wallet. On other chains, the same thieves took at least $103K more from 65 wallets.
Were wallets on other chains drained too?
Yes. The same thieves emptied 65 wallets on eight other chains, mostly Ethereum and BNB Chain. A stolen seed phrase opens every chain a wallet uses. One was emptied on six chains in 17 minutes.
Can stolen USDT be traced to an exchange?
Yes. Every USDT transfer on TRON is public. In this case the money reached CCE Cash, OKX, deBridge and NEAR Intents, and some went to Ethereum and came straight back to TRON through LI.FI. The sooner a victim reports it to the exchange and to Tether, the better the chance of a freeze.
Can I get stolen USDT back?
Only if it is frozen before it moves on, which is why speed matters: Tether can freeze USDT on TRON, and exchanges can hold deposits. Ignore anyone who offers to recover crypto for a fee. That is a common second scam.
Run the next investigation in minutes
Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets, or query the chain directly with the Bitquery API.