Bitquery followed a month of reported iPhone wallet drains on TRON and found a clear money trail: at least $4.06 million in USDT left 365 wallets between 5 October and 4 November 2026. At the 6 November USD/INR close near ₹93.89, that floor is about ₹38.12 crore.
The research does not prove every victim used an iPhone. It does match one published iPhone case to the second — and that on-chain pattern is what Indian self-custody users should study.
What Bitquery found
| Fact | Figure |
|---|---|
| USDT taken on TRON (floor) | ≥ $4.06M (~₹38.12 crore) |
| TRON wallets emptied | 365 |
| Collectors + shared fee wallet | 43 + 1 |
| Other-chain wallets emptied | 65 (≥ $103K) |
| Victims with wallets older than 1 year | 46% |
| Worst day (USDT) | 25 Oct (~31% of total) |
A single fee wallet funded short-lived collector addresses. On TRON, moving USDT needs TRX, so the pattern was often: a few TRX arrive, the whole USDT balance leaves seconds later, then leftover TRX follows. Bitquery counted a victim only when one payment took all of its USDT, so the true total is higher.
The same keys emptied wallets on Ethereum, BNB Chain, Solana and five other networks. One address in use since April 2024 was cleared on six chains in 17 minutes.
DarkSword, Coruna and the phone
Security firms describe DarkSword and Coruna as iOS kits that can land through a booby-trapped Safari page, then hunt Photos, Notes and wallet apps for recovery phrases. Macworld says Apple’s fixes are in iOS 18.7.7 and iOS 26.3; older builds stay exposed. Public target lists include Trust Wallet, MetaMask, Phantom and others.
Bitquery stresses the ledger does not name the phone for most victims and found no evidence of a Trust Wallet app bug. Unverified posts claiming $1.1 million in Trust Wallet losses gave no addresses. The risk sits in the device that holds the seed.
What it means for Indian investors
Self-custody is common after exchange scares. Many Indians keep MetaMask, Trust Wallet or Phantom on the same phone used for WhatsApp and Safari — the surface these kits hunt.
A drain is not a salary write-off. Under section 115BBH, VDA losses generally cannot offset other income. Check the crypto loss set-off calculator before assuming an FIR creates a tax credit. Report drains to Tether and any exchange hit; ignore paid “recovery” offers.
Hardware wallets help; they do not erase seed risk. See our Trezor self-custody note. Paper or metal, never photographed, remains the baseline.
Cash-outs still face Indian tax: 30% plus cess (31.2%) on gains and 1% TDS on many exchange sales. Use the crypto tax calculator, TDS calculator and USDT to INR converter.
Seed storage vs risk (BtcMedia checklist)
| Where the 12/24 words live | Risk if the phone is compromised |
|---|---|
| Photos, Notes, Screenshots, iCloud | High — kits search these first |
| Password manager on the same phone | High if the phone is fully owned |
| Paper or metal plate, offline | Low for this class of attack |
| Hardware wallet + offline seed | Lower; still protect the backup |
BtcMedia verdict: The $4.06 million TRON floor is not a Trust Wallet “hack headline.” It is a reminder that a recovery phrase on an outdated iPhone is a hot wallet by another name. Patch iOS, move seeds offline, and treat an unexpected few TRX as an alarm — then move remaining balances to a new seed on a clean device.
FAQ
Was Trust Wallet hacked? Bitquery found no evidence of a flaw in the app. Public kits target several wallet apps by stealing seed data from the phone. Unverified X posts about $1.1 million in Trust Wallet losses did not publish addresses.
How much was stolen? At least $4.06 million in USDT from 365 TRON wallets (about ₹38.12 crore at ₹93.89/$) plus at least $103,000 from 65 wallets on other chains, per Bitquery’s floor count through 4 November 2026.
What should an Indian holder do today? Update iOS, confirm seed phrases are not in Notes or Photos, watch for unexpected small TRX/ETH top-ups, and if drained, report fast to Tether and exchanges. Use FIU-IND-registered venues for any cash-out — check ours with the FIU-IND exchange checker.
How we calculated this: USD figures from Bitquery’s investigation (verified 5 November 2026); ₹38.12 crore = $4.06M × ₹93.89 (The Hindu’s 6 November provisional USD/INR close). This is not financial advice.