On November 5, blockchain data firm Bitquery released an investigation. From October 5 to November 4, USDT was drained from 365 TRON wallets over the course of a month, with losses totaling at least $4.06 million. All the wallets that lost funds belonged to individuals; no exchanges were affected, and no protocol vulnerabilities were involved.
The funds followed a consistent route. Bitquery identified 43 receiving addresses, all linked to the same funding wallet. Sending USDT on TRON requires TRX to pay transaction fees, so the scammers first sent a few TRX to the victims’ wallets. Seconds later, all the USDT in each wallet was transferred out, along with any remaining TRX. October 25 was the worst day, accounting for about 31% of the total. One transaction was especially clear: a wallet first received 18 TRX, and 18 seconds later, 519,093 USDT was transferred in full to a receiving address. The report doesn’t say how the scammers got the keys. Security firms suspect that iOS tools like DarkSword may have extracted recovery phrases from victims’ phones, but on-chain data can’t prove that step.
Of these 365 wallets, 276 lost USDT and 89 lost only TRX. The median loss was $1,029—not much at first glance, but 8 wallets each lost over $100,000, accounting for 63% of the total. Another 65 wallets lost more than $103,000 across 8 chains, including Ethereum, BNB Chain, and Solana. Addresses linked by the same seed phrase—including one address that had been in use since April 2024—were drained across 6 chains within 17 minutes. 46% of the affected wallets had been in use for over a year. These weren’t newcomers who had just entered the market.
43 receiving addresses and one shared gas-funding wallet—this setup looks like a small assembly line. The receiving addresses are short-lived: they collect funds once, then get replaced. The funding wallet stays active, covering transaction fees for each target in advance. Bitquery also leaves room for doubt: a shared funding wallet can show that these addresses had financial ties, but it can’t prove whether they were controlled by one operator or whether several buyers shared the same tool. The amounts are real; who they belong to is still unsettled. For retail investors, there’s just one takeaway here: the receiving addresses are short-lived. By the time you spot one, the money has already moved. The only recognizable pattern is that they first send TRX, then transfer everything out in one go.
One thing needs to be clear: the blockchain shows where the money goes, not what kind of phone the victim used. Bitquery matched just one of the transactions to a publicly reported iPhone theft based on the amount and timing. The blockchain can’t prove what devices or wallet apps the other wallets used. No vulnerability has been found in Trust Wallet itself, either. Posts online claiming it lost $1.1 million didn’t even provide an address, so they don’t count as evidence.
When I said the culprit behind these 365 wallets is still unknown, I meant just that. The tool itself is real. On November 6, CertiK and SlowMist both warned that the new version of DarkSword was still targeting unpatched iPhones. Apple’s fixes are included in iOS 18.7.7 and iOS 26.3; devices that haven’t been updated are still exposed. In its November 4 report, SEAL said it had received another 6 reports of iOS wallet thefts between October 28 and November 3, with losses of around $127,000. PublicAML continued tracking the activity: between November 5 and 7, another 21 addresses had at least $734,000 transferred out through the same network of funding wallets. This operation is still ongoing.
There are just three things retail investors can do. If you have an iPhone, update it to 18.7.7 or 26.3 now—don’t put it off until you remember later. Don’t store your seed phrase in Photos, Notes, or iCloud. Keep it offline on paper or a metal plate, somewhere inaccessible even if your phone is lost or its system is compromised. If a few unfamiliar TRX suddenly appear in your wallet, treat it as an alarm, not a gift. Move the remaining funds to a new seed and a new wallet immediately. Bitquery puts it plainly in its report: once your seed phrase is exposed, changing your password or revoking approvals won’t help. You must create a new seed phrase and move your funds to a new wallet.
My take is simple: when it comes to wallets being drained, your phone’s operating system and where you store your seed phrase matter more than which wallet you use.
Take a look at your phone right now: is your seed phrase still sitting in Photos or Notes?
— Web3 retail trader Xiao Kai
This article shares personal opinions only and does not constitute investment advice. Data sources: Bitquery, SEAL, PublicAML, and public reports. Amounts reflect figures available at the time of publication. Please assess the risks for yourself.