iPhone Warning: $4.06M Drained From 365 Crypto Wallets, and the Suspected Hacking Kit Is Still Unproven

Between 5 October and 4 November 2026, someone emptied the digital dollars out of at least 365 crypto wallets on a payment network called TRON. The thief did not touch an exchange or a protocol. The victims were individual people holding USDT, a stablecoin, which is a token designed to stay worth one US dollar. A blockchain data firm called Bitquery counted at least $4.06 million gone. Whether iPhones were the way in is the open question, and so far nobody has proved it.

On 6 November, two security firms, CertiK and SlowMist, were among those warning that an iPhone hacking tool called DarkSword is being used against crypto wallets. Trust Wallet, a popular wallet app, told users to update their phones. Bitquery's own report says its data cannot show whether DarkSword had anything to do with most of the losses. This article keeps those two things apart: what was taken, and what is only suspected.

What Bitquery counted

Bitquery is a company that reads public blockchain records and sells the analysis, a bit like a forensic accountant working from a bank's published ledger. TRON is one of the largest networks for moving USDT, and every transfer on it is visible. According to Bitquery, 43 "collection" addresses, the accounts where stolen money landed, were linked by funding flows to one shared wallet that paid the transaction fees.

The pattern, as PANews described Bitquery's findings, was always the same. The thief sent a small amount of TRX, TRON's own coin, which works like postage for a payment. Then the thief moved out everything else. PANews said the thief first needed the victims' private keys. A private key is the secret that authorises spending from a wallet, and a wallet's 12 or 24-word recovery phrase can regenerate it, so anyone holding either holds the money.

The count has limits. Bitquery counted only payments that emptied an address's USDT balance. It left out swap payouts, transfers inside the network and senders it could not classify. The 365 wallets include 89 that lost only TRX. One transfer on 25 October moved 519,093 USDT to one collecting address, a TRONSCAN record shows. Bitquery says the shared fee wallet establishes a network through money flows, but that control by a single operator remains unproven.

Three numbers, three sources

The loss figure depends on who is counting.

$4.06 million from 365 TRON wallets. This is Bitquery's own figure for the TRON drains, published on 6 November. It is the best sourced because the firm explains its method and the transfers are public. It is a floor: Bitquery says "at least".

About $4.16 million from 430 wallets. PANews, citing Bitquery, added 65 more wallets drained across eight other chains, including Ethereum and BNB Chain, for losses above $103,000. The two pieces add up to about $4.16 million. The extra chains are PANews's reading of the same group's activity, not a separate Bitquery total.

Up to $5.57 million from more than 20 wallets. This figure ran widely on 6 November. ChainCatcher's version credits unnamed "security researchers and KOLs" (key opinion leaders, crypto's word for influencers) and says at least 18 malicious websites were identified. It gives no forensic report and no named source. It describes the sum as "up to". CMZ found no primary source for it, and it does not match Bitquery's count of wallets.

Security Alliance, a group that collects such reports, separately logged six iOS wallet compromises worth about $127,000 between 28 October and 3 November, involving several Trust Wallet accounts and one Uniswap Wallet, according to Cryptonews.

Who blames DarkSword, and how sure they are

DarkSword is real, and it is not new. Google's Threat Intelligence Group (GTIG) described it on 18 March 2026, working with the mobile security firms Lookout and iVerify. It is an exploit kit, a ready-made toolbox that chains several software flaws, here six in Apple's iOS. A victim only has to open a booby-trapped web page in Safari, the iPhone's browser. GTIG said it targets iOS 18.4 through 18.7, and that a Russia-linked group it tracks as UNC6353 used it against Ukrainian websites, a Turkish surveillance vendor called PARS Defense used it in Turkey and Malaysia, and another group, UNC6748, used it in Saudi Arabia. One of its payloads, GHOSTBLADE, collects cryptocurrency wallet data among many other things.

The step from that report to these thefts is where the evidence stops.

Bitquery says it matched one reported theft to an iPhone owner's account by amount and timing, and tracked other addresses by traits such as emptied balances. It also says on-chain records cannot show which phone or wallet app any victim used, so it cannot confirm that all the losses came from the iPhone flaws or DarkSword.

CertiK warned on 6 November that a newer DarkSword variant is being used against crypto wallets on unpatched iPhones, and that visiting a malicious site could be enough, with no wallet connection or approval needed. That is a warning about capability. CertiK did not claim to have traced the TRON thefts to it.

SlowMist published an analysis of a Safari attack campaign in September that reused DarkSword techniques. It said it had not tied the sample to any confirmed theft, and had not run the full chain on a real victim's phone.

Trust Wallet said DarkSword and Coruna, a related kit, exploit older iOS versions rather than flaws in wallet apps, according to The Defiant.

One victim is on record. A Ukrainian user said on Instagram that 68,327 USDT left his Trust Wallet on 15 October, that his iPhone ran an outdated iOS, and that he suspected DarkSword. ForkLog noted there is no independent confirmation.

Other researchers describe how the kits spread. Censys, a firm that scans the internet, reported servers holding DarkSword and Coruna files, and Macworld reported the kit hunts Photos and Notes for recovery phrases. On 21 October iVerify and Report URI described malicious adverts and abandoned analytics tags delivering the kits, and iVerify reported one infection that came through an Instagram advert.

None of this proves that DarkSword emptied the 365 wallets. No source reviewed by CMZ says it does.

Which iPhones, and what Apple fixed

Apple is not accused of anything here. The flaws were found and fixed. GTIG said it reported them to Apple in late 2025 and that all six were patched by iOS 26.3, though most were fixed earlier. By GTIG's table, the fixes arrived in iOS 18.6, 18.7.2, 18.7.3, 26.1, 26.2 and 26.3. Apple's note for iOS 26.3, as reported by CyberInsider, said it knew of a report that one of the flaws, a bug in a component called dyld, may have been used in attacks on specific targeted people on versions before iOS 26.

Macworld, summarising the Censys work, wrote that the attacks continue against iPhones on iOS 26.2 and earlier. SlowMist's strongest evidence covered iOS 18.4 through 18.6.2, and it said it preferred not to call iOS 26.5 affected without reproducible proof. Other reports claim newer versions are at risk, and SlowMist itself called that unconfirmed. An iPhone running current software is not covered by any of these findings.

What happened next

No arrest, seizure or attribution to a named group has been reported. Nobody has claimed the thefts. Trust Wallet's 6 November advisory, as reported, urged users to install the latest iOS available for their devices and keep recovery phrases out of screenshots and notes. CertiK and GTIG gave similar guidance, and GTIG added Lockdown Mode, Apple's strict security setting, for phones that cannot be updated. PANews reported no current evidence that Trust Wallet or similar apps themselves are flawed.

Binance's former chief executive Changpeng Zhao also urged users to update their iOS, reported ChainCatcher. Bitquery's window ended on 4 November, so thefts after that date are not counted.