Zero-Click iOS Exploit Claims: $4M USDT Drained from 365 TRON Wallets in Coordinated Theft

Event Analysis

According to Bitquery and CryptoSlate, at least $4.06 million in USDT was removed from 365 TRON addresses between October 5 and November 4, 2026. The theft was coordinated through a common fee wallet and 43 collector addresses — attackers pre-funded victims' wallets with TRX to cover transaction fees before draining USDT and remaining TRX. One representative transfer moved approximately 519,093 USDT to collector wallet TEDjN on October 25. An additional 65 wallets across eight other chains were reportedly drained, with losses exceeding $103,000.

The attribution to a "zero-click iOS exploit" requires an important qualification: while reports link the activity to iOS malware kits including DarkSword and Coruna, CryptoSlate notes that 89 of the 365 addresses lost only TRX, and the evidence does not confirm that every address was compromised via a zero-click exploit or that Trust Wallet itself was vulnerable. The attack pattern — TRX fee top-ups immediately before USDT withdrawals — is more consistent with private key compromise than a direct smart-contract failure on the TRON network.

What distinguishes this incident is its operational sophistication: a centralized fee wallet funding hundreds of target addresses across a 30-day window suggests an organized theft network rather than opportunistic attacks. This falls squarely within the crypto wallet exploit & theft wave and raises systemic questions about mobile wallet security at scale. If a weaponized iOS vulnerability is confirmed, the implications extend well beyond TRON — any crypto wallet app on an unpatched iPhone would face the same exposure.

Regulatory scrutiny is a credible secondary risk. Confirmed targeting of active wallets could accelerate calls for mandatory mobile wallet security standards and tighter USDT issuer blacklisting protocols, particularly given the ongoing multi-jurisdiction crypto regulatory tightening environment.

What This Means for Traders

TRX is trading at $0.3174, down 0.38% over 24 hours — a muted reaction that reflects the market's current read: contained incident, not systemic shock. The stolen USDT does not create forced mechanical TRX selling, so a sharp directional move is not supported by the evidence alone. Watch for exchange freeze announcements, Tether blacklisting of identified collector wallets, or official Apple security disclosures — any of those would escalate the story and could trigger sharper TRX and TRON-ecosystem repricing. Traders following crypto perpetual futures on TRX should monitor funding rates and open interest for confirmation signals before sizing directional positions.

The broader USDT-on-TRON ecosystem faces friction risk: exchanges may delay or screen TRON-USDT deposits, raising settlement friction but not threatening USDT's dollar peg or Tether's backing. For blockchain security and cybersecurity-adjacent equity plays, the incident reinforces demand for mobile threat detection and on-chain analytics — though no specific public-company revenue impact is currently established. The most relevant watchpoints are additional drain disclosures, regulatory responses, and whether Apple issues a formal CVE acknowledgment.

Trade TRON on CoinUnited.io

Trade TRX with up to 2000x leverage → | Create Free Account

_Availability and maximum leverage depend on product, jurisdiction and account eligibility. Leverage amplifies losses and positions can be liquidated._