Bitquery traced at least $4.06 million in USDT losses between Oct. 5 and Nov. 4, 2026, across a network involving 365 TRON addresses, including 89 that lost only TRX. Funding flows connected 43 collector wallets to a common wallet used to pay transaction fees, establishing a money network without proving that one operator controlled all the addresses. The device connection is narrower: Bitquery matched one Oct. 15 theft to a published iPhone-owner account, while most devices and exploits remain unidentified. Address totals do not indicate the number of unique victims, and the USDT figure excludes TRX. In one identified theft, a TRONSCAN transaction record showed 519,093.330005 USDT moving to collector TEDjN on Oct. 25. Bitquery counted payments that emptied an address's USDT balance, excluding swap payouts, transfers within the network and unclassified senders. Separately, Security Alliance logged six iOS wallet-compromise reports involving approximately $127,000 in losses from Oct. 28 through Nov. 3, across multiple Trust Wallets and one Uniswap Wallet. Research has also documented iPhone risks involving the P7 DarkSword spyware variant and the Coruna and DarkSword exploit kits. Google Threat Intelligence Group recommended updating iOS or enabling Lockdown Mode when updates were unavailable, while Trust Wallet repeated device-security guidance in a Nov. 6 advisory.