One fee wallet paid the network charges. Forty-three short-lived collectors took the money. Between 5 October and 4 November they pulled at least $4.06M in USDT out of 365 wallets on TRON, per an on-chain investigation Bitquery published on 5 November.
Reports since mid-October blamed iPhone malware for emptying crypto wallets, but nobody had tied victim accounts to ledger entries until now.
One theft matched to the second
The proof came from a Russian-language report on a stolen balance. That victim opened a video in Safari, tapped an advert and landed on a page that took over the handset. Read in UTC, the account lines up exactly: 16,428 USDT left at 07:29:48, with the remaining TRX following twelve seconds later.
Researchers suspect an exploit kit of the kind traded as DarkSword, which compromises an iPhone through the browser alone. Bitquery was careful: its data shows wallets, not handsets, so most victims’ devices stay unidentified.
Why the fee wallet matters
Moving USDT on TRON costs a charge paid in TRX, and many holders carry almost none. The operators cover it. A few TRX arrive, the whole balance leaves for a collector, then the leftover TRX is reclaimed. That pattern became the search key. The same crew cleared 65 more wallets across eight other chains for at least $103K.
Forty-six percent of drained addresses had held funds over a year. Half the victims lost under $1,029, while eight of $100,000 or more made up 63% of the total.
A shared fee wallet links the collectors by money, but Bitquery stops short of claiming one operator: exploit kits are sold and rented. It found no flaw in any wallet app. The advice is blunt: keep iOS current and never park a recovery phrase in Photos, Notes or a screenshot.
