Transfers Reveal $4.06 Million Theft from 365 Wallets on the TRON Network
Key Facts
Bitquery Research said it traced at least $4.06 million in USDT withdrawn from 365 wallets on the TRON network between October 5 and November 4, 2026. The finding quantifies the funds the company tracked on-chain during that period, while its description of the amount as a minimum indicates the estimate does not cover every potential loss. Bitquery traced the funds to 43 short-lived consolidation wallets linked to a single wallet used to pay fees. The company said 39 of the consolidation wallets interacted directly with the fee wallet or emptied victims' balances that they had just funded, while the other four were linked to it through an intermediary or another consolidation wallet. These financial links provide a path for tracking the movement of funds between wallets, but do not by themselves identify who controlled them.
Bitquery did not link most withdrawals to a particular phone or app, saying the transfer records show the movement of funds but do not reveal the device that may have exposed a wallet's passphrase. The company was able to match one case to a published account by a victim who said the theft was linked to an iPhone. On October 15, 16,428 USDT left the wallet in that case, followed 12 seconds later by the remaining TRX. Bitquery said the transfers matched the victim's published account down to the timing of the movement. The match places one documented case within the investigation, without proving that all affected wallet owners used an iPhone or were exposed to the same method.
Bitquery data show that 46% of the wallets from which funds were withdrawn had held balances for more than a year before the theft, and 87% had held funds for more than a month. This means most of the addresses in this measure were not recently funded before losing money, while nearly half had held balances for more than a year. By contrast, the company said 89 victims lost TRX alone; they were not included in the reported count of stolen USDT wallets. Bitquery also excluded cases in which some USDT remained in the wallet after a payment transaction. The figure of 365 therefore covers wallets from which the investigation tracked USDT withdrawals under the company's stated counting criteria, and does not necessarily represent every address that suffered any loss during the period.
Losses were unevenly distributed across addresses. Bitquery said half of the addresses that lost USDT lost less than 1,029 USDT, while 8 addresses each suffered losses of at least 100,000 USDT. Losses from those 8 addresses together accounted for 63% of the total stolen USDT counted in the investigation. October 25 recorded the largest daily losses, when two victims lost a combined 1.21 million USDT. The report estimated that day's share at about 31% of the total currency withdrawn during the investigation period. These figures combine a large number of smaller losses with most of the amount concentrated in a limited number of addresses.
Bitquery also traced part of the funds after they moved from the thieves' addresses on Ethereum to the TRON network. During the 10 days following October 25, the company tracked $1.51 million in transfers through LI.FI, an application that routes funds between networks. The 71 transfers on TRON in turn sent funds to 8 new wallets, most of what they received being USDT. The investigation also tracked an additional $62,000 returning through the USDT0 bridge. These movements show that the funds' path was not limited to one network, with tracked value moving through Ethereum before returning to TRON. These figures cover only the transfers Bitquery tracked from October 25 to November 4 and do not represent the full value of the original thefts.
On the initial funding path, Bitquery said the fee wallet received two transfers from hot wallets belonging to Bybit and HitBTC within one hour on October 18. The Bybit hot wallet sent 571 USDT, while the HitBTC hot wallet sent 485 USDT to the fee wallet. The transfers add a connection between the platforms' wallets and the wallet that funded other transactions in the investigation. However, the source describes these transfers as observed money flows and does not establish who requested them or who controlled the receiving wallets. In the broader security context, iVerify and Report URI reported that the Coruna and DarkSword exploit kits could be delivered through ads or page elements while browsing, requiring a visit to an infected site but no click on the ad. iVerify said observed versions of DarkSword targeted cryptocurrency wallet apps, including TronLink, while Lookout said in March that DarkSword targeted iOS versions 18.4 to 18.6.2; however, Bitquery's investigation did not establish that these tools caused most of the thefts it tracked.
In recommendations separate from the theft investigation, Lookout urged organizations in March to update devices to iOS 18.7.3 or later, or iOS 26.3 or later, and to retire unsupported devices. The update recommendation targets the versions the company identified in its DarkSword report and does not establish the cause of every withdrawal tracked by Bitquery. AxIOS reported in October that researchers had seen iPhone infections begin through online ads without users clicking a malicious link, with spyware used to steal credentials and search for cryptocurrency wallets. Those security incidents remain separate context from Bitquery's limited match between the transfers and a published account by one victim. The financial investigation figures cover transfers the company tracked on TRON between October 5 and November 4, 2026.