The iPhone wallet drain network did not stop: 734,424 USDT from 21 more TRON wallets after Bitquery’s report, 601,751 of it on 7 November

Bitquery’s report of 5 November started from one theft described by an iPhone owner and found the same pattern on 365 TRON wallets between 5 October and 4 November: a fee wallet, TUYFAa8hHjeEW6bPqBJ4v3RjQR2uKM1Svk, or a collector it funded sends a victim a few TRX; seconds later the victim’s whole USDT balance moves to a collector that lives a day or two; then the leftover TRX goes too. The collectors swap USDT for USDD at the USDD mint and cash out through CCE Cash (until 25 October), then deBridge and NEAR Intents. Bitquery counted at least $4.06M in USDT from 365 wallets and $103K more on eight other chains. It ties the thefts to the phone, not to any wallet app: security researchers describe iPhone exploit kits (DarkSword, Coruna) that search a phone for seed phrases, and Apple’s iOS 18.7.7 and 26.3 updates close the holes. Bitquery’s data runs to the morning of 5 November.

The fee wallet did not go quiet. On 5 November at 19:35 UTC it sent 10 TRX and then 5 TRX to TEkFvMxHb8MZ5ibn2KvxykofxF8rTjFKxr, a wallet in use since June. At 19:36:36 that wallet’s 3,994.92 USDT went in one payment to a collector created that evening, TJbCvACEpEMVwi2zYGXuoT2HSBnFLosVLz. At 21:18 the same thing happened to a second wallet: 13.5 TRX from the fee wallet, then its 350.15 USDT to the same collector 21 seconds later. Overnight that collector also emptied wallets of WIN and NFT tokens, and on 6 November it passed 5,791.85 USDT to a go-between, TLVpM9gLCAXaMqe1Wv2EwbMc1aystXeZ7J, which in turn paid TRX back to the fee wallet.

A second collector, TAgpYPQNdA9SCFfe2RgkaH8kkb7JZTaDcV, opened on 6 November at 17:31 UTC and worked for a day. It took money from 17 wallets, eight of them right after sending each one 5 to 20 TRX for the fee. Its two largest were on 7 November: at 12:56 UTC it sent 20 TRX to TFhvXEBmKCUNS6RpxGPUJocX8iJ7Gc2Tto and 13 TRX to TH1Q7LXz1vkx6UCYMxCBVpaD6AZWbrAwfH; 18 and 54 seconds later they sent it 49,440.25 USDT and 50,010 USDT. At 17:32 UTC it paid 6.65 TRX to the fee wallet. Every one of the 21 wallets we count holds 0 USDT now; we left out three senders that are busy wallets still holding large balances.

At 17:02:27 UTC TXPryvpXUqruHnx4hbgXrDYKN8wTkfMq73, a wallet first funded in October 2021 that had barely moved since 2023, sent its whole balance, 601,751.60 USDT, to a collector that did not exist a minute before: TJCY7r7shYmy3yWncGB9MvwWa8QS6du2C5. Fifteen seconds later the wallet’s 766.50 TRX followed. This victim had enough TRX of its own, so no top-up was needed. Four minutes later, at 17:06:42, the fee wallet TUYFAa8hHjeEW6bPqBJ4v3RjQR2uKM1Svk sent the new collector 30 TRX. That payment is the link to the network.

From 17:10 to 17:14 UTC the collector swapped 601,721 USDT for USDD at the USDD mint (TSUYvQ5tdd3DijCD1uGunGLpftHuSZ12sQ) in seven swaps of 51,721 to 100,000. USDT is issued by Tether, which can freeze it on any address. USDD is a different stablecoin, and Tether cannot freeze it.

At 18:20 UTC the collector sent 120,000 USDD to TJPPRcxoboMkhpKdKgvcCEdjwbHJjSpb2G, a wallet activated at 12:48 UTC that day. Within three minutes it had redeemed the USDD for USDT at the mint, swapped the USDT straight back into USDD, and sent the USDD in two payments to a second wallet, TJLsZ7jbbDSUECJGM19QC6B6wPwa4Bed4c, activated a minute after the first. That one redeemed it for USDT again and paid it to TFG4wBaDQ8sHWWP1ACeSGnoNR6RRzevLPt in pieces of 50,000, 50,000 and 20,000 between 18:25 and 18:32. At 18:56 the collector sent the next 120,000 USDD the same way. The first pass-through wallet had already handled 142,727 USDD from the 6 November collector the same afternoon. In all, the second pass-through wallet paid 282,727 USDT to the busy wallet on 7 November. At 19:10 UTC 361,721 USDD was still on the collector.

The round trips through the mint add no value. They change which token sits on which address, so that someone watching only USDT transfers sees money appear from the mint rather than from a victim. The busy wallet TFG4wBaDQ8sHWWP1ACeSGnoNR6RRzevLPt held about 20 million USDT and trades with many counterparties. It looks like an OTC desk or a service’s wallet, not one of the thieves’ collectors, and we have not labelled it. Whoever runs it knows which customer the 282,727 USDT was credited to.

We filed the fee wallet, the three new collectors, the two pass-through wallets, the 6 November go-between and four collectors from Bitquery’s report in PublicAML’s database as one incident, so any check of these addresses or of wallets that trade with them shows the link. We did not label the victims. At about 18:40 UTC on 7 November we asked Tether to blacklist the two pass-through wallets, which every batch of the remaining USDD has passed through as USDT so far, and we sent the USDD side the collector’s address. We are watching the collector, and this page will be updated when the USDD moves.

An unknown address sending you a few whole TRX is the warning sign: in this network it came seconds before every theft. Poisoning bots send dust, not whole TRX. If it happens and your USDT is still there, move it at once to a new wallet created from a new seed phrase on a device you trust, and move what you hold on other chains too, because one seed phrase opens all of them. Update iOS (18.7.7 or 26.3 and later), and keep the seed phrase off the phone: no photos, notes or screenshots. If you were drained, check your address on PublicAML, report it to Tether and to any exchange the money reached, and ignore anyone who offers to recover it for a fee.

It does not say who runs the network, which phone or app any victim used, or that Apple, Trust Wallet, Tether, the USDD issuers or the owner of the busy wallet did anything wrong. A shared fee wallet ties the thefts together by money. It does not prove that one person runs them all. The network, its first 365 victims and the iPhone link are Bitquery’s findings; the thefts after 5 November, the 7 November cash-out and the balances are PublicAML’s own reading of TRON on 7 November 2026, 17:00–19:10 UTC. We count a wallet as a victim when one payment to a collector took all its USDT and it now holds none, so the 734,424 USDT is a floor.