Trust Wallet urges iPhone users to update iOS, delete recovery phrase screenshots amid wallet theft reports

Bitquery has traced at least $4 million in suspected USDT theft to 43 collector wallets on TRON between October 5 and November 4, 2026, as researchers and Trust Wallet warn of iPhone exploit kits targeting crypto holders. The blockchain firm said on-chain data cannot show how victims’ devices were compromised.

How Bitquery traced the $4 million cryptocurrency theft

Bitquery’s investigation provides more detail about how the stolen funds moved across the TRON blockchain. According to the blockchain analytics company, the operation involved 43 collector wallets connected through funding transactions to a shared wallet responsible for paying network fees.

This connection allowed investigators to identify a wider pattern of suspicious transactions. However, Bitquery stressed that financial links between cryptocurrency addresses do not automatically establish that all the wallets belong to one individual or criminal organisation.

The investigation covered transactions between October 5 and November 4, 2026. During that period, the identified collector wallets received substantial amounts of USDT from cryptocurrency addresses that were subsequently emptied.

One particularly significant transaction occurred on October 25, when approximately 519,093 USDT was transferred from a victim’s wallet to a collector address identified as TEDjN.

The transaction provided investigators with a concrete example of how quickly substantial cryptocurrency balances could disappear.

Bitquery also explained its methodology for calculating the losses. The company counted transactions that completely emptied an address’s USDT balance while excluding internal transfers, swap payouts and payments from senders whose activities could not be reliably classified.

Importantly, the 365-address figure should not be interpreted as 365 confirmed iPhone victims. The original investigation included 89 addresses that lost only TRX rather than USDT.

Furthermore, blockchain records alone cannot establish which mobile application or device each affected wallet owner used.

The findings surrounding Zero-click iOS exploits therefore provide investors with an important distinction between identifying suspicious blockchain activity and establishing precisely how individual devices were compromised.

iPhone wallet attacks raise fresh concerns about mobile security

The Bitquery findings come amid separate reports of cryptocurrency theft involving compromised iPhones.

Security Alliance reportedly documented six iOS wallet-compromise incidents between October 28 and November 3, 2026. The incidents involved approximately $127,000 in reported losses across multiple Trust Wallet accounts and one Uniswap Wallet.

These reports suggest that the problem extends beyond a single cryptocurrency wallet provider. Instead, the security of the mobile operating system, the handling of recovery phrases and the exposure of sensitive information may all contribute to the risks facing investors.

Researchers have also identified malicious advertising campaigns and compromised analytics tags as possible delivery methods for sophisticated iPhone exploit kits.

These exploit kits have attracted attention because of their ability to target vulnerable Apple devices and access information that could expose cryptocurrency holdings.

Google’s Threat Intelligence Group previously published research on DarkSword on March 18, 2026. Its investigation documented the use of the exploit chain by multiple threat actors and identified vulnerabilities affecting certain iOS versions.

The research demonstrates why Zero-click iOS exploits deserve attention from cryptocurrency investors. A compromised smartphone can expose sensitive information even when the investor has not intentionally authorised a suspicious blockchain transaction.

In practical terms, criminals who obtain access to recovery phrases or other wallet credentials may be able to transfer funds without needing the victim’s permission for each transaction.

The blockchain investigation does not establish that every affected address was compromised through DarkSword, Coruna or any single attack method.

What cryptocurrency investors should do to protect their wallets

The growing reports surrounding Zero-click iOS exploits underline the importance of treating smartphone security as part of cryptocurrency investment management.

Many investors concentrate on exchange security, wallet passwords and two-factor authentication. While these protections remain important, they may not be sufficient when the underlying mobile device is vulnerable to sophisticated malware.

Trust Wallet issued a security advisory on November 6, 2026, urging iPhone users to install the latest available iOS updates. The company also warned against keeping recovery phrases and private keys in screenshots, photographs or note-taking applications.

The lesson from Zero-click iOS exploits is that securing digital assets requires more than protecting private keys. The devices used to access those keys are equally important.

Implications for the wider cryptocurrency market

The incident also raises questions about the security standards expected of mobile cryptocurrency applications. As digital asset adoption increases, investors are relying more heavily on smartphones to store, manage and transfer funds.

Zero-click iOS exploits could undermine confidence in mobile wallet security if vulnerabilities remain unpatched or sensitive recovery information is exposed. This is particularly relevant to investors who maintain substantial USDT balances for trading, payments and liquidity management.

The reported thefts also demonstrate the importance of blockchain analytics in cryptocurrency investigations. Although transactions on public networks can be traced, identifying the individuals behind suspicious addresses and recovering stolen assets remain separate challenges.

Bitquery’s findings indicate that investigators were able to follow some stolen funds through cryptocurrency services and cross-chain transactions. However, tracing a transaction does not guarantee that the funds can be recovered.

For stablecoin holders, the possibility of freezing stolen USDT may offer an additional response mechanism, provided the relevant issuer receives credible reports and can identify the assets before they move further.

Zero-click iOS exploits represent a security challenge that investors, wallet developers and blockchain infrastructure providers cannot afford to overlook.

The incident reinforces the need for stronger mobile security practices as cryptocurrency ownership becomes increasingly integrated with everyday digital devices.