Research links TRON wallet thefts to a shared fee network; iPhone cause remains unproven across victims
Bitquery estimates at least 4.06M USDT was drained across a cluster of 365 TRON wallets. PublicAML links at least 734,424 USDT in outflows from 21 more addresses to the same fee wallet. These are separate research estimates, and address counts do not identify people. One case matches an iPhone report. Other devices, apps and causes remain unknown.
- Disclosed
- Nov 5, 2026
- Updated Nov 7, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Self-custody wallets whose keys or seed phrases may be exposed; no platform-wide iPhone or Trust Wallet compromise is established.
- TRON · Wallet theft · Seed phrases
- In the wild
- Yes
- Traced theft patterns; most victims’ devices and attack causes remain unknown.
What happened
The TRON count is 365 addresses, not 365 confirmed iPhone users; 276 lost USDT and 89 lost only TRX. A shared fee wallet ties transactions together but could serve multiple buyers of an attack kit. Three collectors have a weaker link: their 24 victims and 530,131 USDT are included in the estimate. The report correlates one theft with a published iPhone narrative by amount and timing, without device forensics proving the wider cause. It cannot establish a Trust Wallet flaw, general iPhone compromise or a link to the separate Poisoned Source campaign. Its separate estimate covers 65 wallets on eight other chains and at least $103K at a different valuation basis. That count does not establish 65 additional people. Do not turn the traced $1.86M JustLend deposit or $1.51M LI.FI route into extra theft totals; not all routed balances are established stolen funds.
SEAL’s November 4 report records six iOS wallet-compromise reports and about $127,000 in reported losses from October 28 through November 3, across multiple Trust Wallets and one Uniswap Wallet. The overlap with Bitquery’s cluster is unknown, so keep the estimates separate. Trust Wallet’s November 6 guidance discusses Coruna and DarkSword as risks for older iOS builds and recommends updating the device and keeping keys and recovery phrases out of notes and images. It gives no finding about the cause or operator of this theft network.
November 7 tracing. PublicAML ties three new collectors to Bitquery’s fee wallet and estimates outflows of at least 734,424 USDT from 21 addresses. One transfer moved 601,751.60 USDT at 17:02:27 UTC on November 7. About four minutes later the fee wallet sent that collector 30 TRX. The researcher counts an address when a single payment to a collector empties its USDT balance. Keep this estimate separate from Bitquery’s earlier window. PublicAML also traced 744,448 USDT through intermediaries to an unlabelled address. That figure includes previously counted funds and does not represent additional losses. PublicAML says it requested freezes. No freeze or recovery was confirmed. The follow-up does not identify the affected devices, apps or attack mechanism, or establish a single controller for the linked addresses.
Crime-scene timeline
Oct 5–Nov 4, 2026
Research traces TRON theft-pattern transfers
The report bounds its wallet counts to this period; links are financial relationships, not proof of one operator or device exploit.
Nov 4, 2026
SEAL summarizes iOS wallet compromise reports
Six reports account for about $127,000 in reported losses. Overlap with the Bitquery cluster is unknown.
Nov 5, 2026
Bitquery publishes its investigation and correction
The fee wallet received its first money before becoming live 19 minutes later, correcting an earlier sequence. Other-chain valuations use October 25 closing prices; later transfers and TON losses are outside its measured scope.
Nov 6, 2026
Trust Wallet publishes iOS safety guidance
The company recommends current iOS and keeping recovery phrases and private keys out of phone notes and images. Its guidance gives no case-specific finding.
Nov 7, 20:40 UTC
PublicAML traces further transfers
It links three new collectors to the same fee wallet and estimates at least 734,424 USDT left 21 TRON addresses from November 5 at 19:36 to November 7 at 17:02 UTC. Onward transfers and freeze requests are tracked separately.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Bitquery original TRON and cross-chain investigationPrimaryNovember 5 analysis, corrected funding sequence, wallet-level counts, bounded cross-chain tracing, full address/transaction record and explicit limits on iPhone/app attribution. Figures are not independently confirmed.
- Security Alliance incident-response roundupPrimaryReports six iOS wallet-compromise reports and approximately $127,000 in reported losses. Overlap with the Bitquery dataset is unknown.
- Trust Wallet iOS safety guidancePrimaryRecommends current iOS and keeping keys and recovery phrases out of phone notes and images. Provides no case-specific root-cause finding.
- PublicAML follow-up TRON tracingPrimaryIndependently reads chain data, documents November 5–7 transfers, its counting rule and 35 addresses with roles, and reports freeze requests. Does not verify devices, attack method, ownership or a completed freeze.