Last reviewed 7 November 2026. Figures come from Bitquery's on-chain investigation, verified on 5 November, and are a floor. Ryder makes a hardware wallet, so weigh our advice accordingly.
If you found your wallet drained in the past month, especially of USDT on the Tron network, you may be one of roughly 430 victims of the same operation. The blockchain data firm Bitquery traced the money from one documented iPhone theft and found a coordinated group that took at least 4.16 million USD between 5 October and 4 November, almost all of it as USDT on Tron. What the ledger shows also gives you a warning sign to watch for, a short list of things to do if it already happened, and a clear picture of where the stolen money went.
What Bitquery found
The bulk of the theft sat on one network: at least 4.06 million USD in USDT taken from 365 Tron wallets, plus another 65 wallets emptied across Ethereum, BNB Chain, Solana, Base, Arbitrum, Optimism, Polygon and Avalanche for at least 103,000 USD more. Bitquery counted a victim only when a single transfer emptied the wallet's whole USDT balance, so the real total is likely higher. A separate tally from the Russian-language site cpa.rip, which Bitquery cites, puts the Tron losses at 7.88 million USD.
The operation ran on a simple structure. One fee wallet, first funded on 5 October, paid for 43 short-lived collector wallets, and most of those collectors lived for a day or two, took money from a handful of victims and then went quiet while a new one replaced them. Forty-one of the 43 had emptied every victim they were assigned within two days.
The warning sign: a small gift of TRX
Moving USDT on Tron costs a network fee paid in TRX, and many wallets that hold USDT keep almost no TRX. The thieves solved that by sending a little first. In the largest case on 25 October, the fee wallet sent 18 TRX to a victim at 23:16:21 UTC, and 18 seconds later 519,093 USDT left that wallet for a collector, followed by the leftover TRX less than a minute after.
That pattern only works if the attacker already holds the wallet's key, which is why a deposit you weren't expecting is worth treating as an alarm rather than a windfall. Bitquery suggests the same caution on other networks, where a tiny unexplained amount of ETH or BNB can play the same role.
How it connects to iPhones
The case Bitquery started from was reported by an iPhone owner who said they opened a video in Safari, tapped an ad that led to another page, and later found their wallets empty. On 15 October at 07:29:48 UTC, one of that owner's addresses sent exactly 16,428 USDT to a collector, with the last of its TRX gone 12 seconds later, which matches the owner's account to the second. The report suspects an iPhone hacking kit such as DarkSword, which Google documented in March as able to take over iPhones on iOS 18.4 through 18.7 from one web page.
Bitquery is careful about the limits of what the chain can show. A blockchain never records which phone or wallet app signed a transfer, and links between wallets are money links that don't prove one person controls them, so the data proves one coordinated operation and one exact match to an iPhone infection without proving every victim used an iPhone. Bitquery also writes that it can't say Trust Wallet was hacked, even though Trust Wallet users appear among recent iPhone theft reports.
Who lost money
The victims don't look like careless newcomers. Almost half of the drained wallets had been in use for more than a year, 87 percent for more than a month, and 78 percent had paid other addresses before, so these were people's working wallets rather than exchange deposit addresses being swept. Most losses were modest, with a median of about 1,029 USD, and the 48 percent of victims who lost under 1,000 USD account for only 1 percent of the money. Eight wallets that each lost more than 100,000 USD account for 63 percent of the total, and 25 October was the worst day, when two large holders lost about 1.21 million USD between them.
Where the money went
Collectors often swapped the stolen USDT for USDD, another stablecoin on Tron, then passed it on. Until 25 October most of it left through CCE Cash, and after that the group spread out: about 650,000 USD crossed to Ethereum and Optimism through deBridge, about 215,000 USD went through NEAR Intents, a lending wallet on JustLend took 1.86 million USD in and out, and smaller amounts went through OKX and the USDT0 bridge. Bitquery also found the fee wallet received minor withdrawals from the exchanges Bybit and HitBTC on 18 October, and notes that those exchanges know who made them.
Wallet drained? What to do first
Speed matters most in the first hours. Report the theft to Tether, which can freeze USDT at specific addresses, and to any exchange the money reached, including the transaction IDs. If anything is left in a wallet you suspect, move it now to a new wallet created on a clean, updated phone with a new recovery phrase, and never use the old phrase again.
Then close the door the thief came through. Update your iPhone to the latest iOS, or to iOS 18.7.7 if it stays on iOS 18, and remove any recovery phrase from Photos, Notes, screenshots and cloud files, writing it on paper or metal instead. Ignore anyone who offers to recover your funds for a fee, because Bitquery flags these offers as a common second scam aimed at people who were just robbed.
Where a hardware wallet fits
Every drain in Bitquery's data needed the attacker to hold the wallet's key, and an infected phone is one of the easiest places to find it. A hardware wallet keeps the key inside its own chip, so a compromised phone has nothing to copy, and it shows each transfer on its own screen before you approve it.
There's a limit you should know before buying ours. Ryder One supports Bitcoin, Ethereum and Solana along with tokens on Ethereum and Solana, and it doesn't support Tron, so USDT held on Tron can't be stored on it directly. If that's where most of your money sits, either choose a hardware wallet that supports Tron or move your stablecoins to Ethereum or Solana first, checking the network carefully before you send. For holders on the networks we do support, the key is generated inside an EAL6+ certified secure element and never leaves it, and our checklist on your first hardware wallet covers what else to compare.
Share: