TRON network theft drains $4 million in USDT

Blockchain data firm Bitquery has traced at least $4 million in USDT thefts involving 365 TRON addresses between October 5 and November 4, 2026. The investigation revealed that 276 addresses lost USDT, while 89 addresses lost only TRX.

Investigators observed a pattern where thieves sent small amounts of TRX to victim wallets to cover transaction fees, immediately followed by the total drainage of USDT balances. Bitquery linked 43 collector wallets through shared funding flows to a common transaction fee wallet, though a single operator has not been proven.

While the majority of the 365 victims' devices and compromise methods remain unidentified, researchers have noted a potential link to iOS exploit kits such as “DarkSword” and “Coruna”. Only one specific theft was directly confirmed to involve an iPhone-owner account.

The impact appears to extend beyond the TRON network, with Bitquery reporting at least $103,000 stolen from 65 wallets across eight other blockchains, including Ethereum, BNB Chain, and Solana.