- Blockchain analytics platform Bitquery identified a network of 43 collector wallets linked by shared fee-funding flows, including a single Oct. 25 transaction that transferred over 519,093 Tether ($USDT) to one collector.
- Security Alliance recorded six iOS wallet-draining incidents between Oct. 28 and Nov. 3, resulting in roughly $127,000 in losses across Trust Wallet and Uniswap Wallet applications.
- Cybersecurity researchers at iVerify, Report URI, and Google Threat Intelligence Group tied recent iPhone crypto thefts to malware campaigns involving the Coruna and DarkSword (P7) exploit frameworks.
Bitquery Traces Tether Thefts to Linked Collector Wallets
On-chain investigations by blockchain intelligence provider Bitquery have uncovered a coordinated web of addresses associated with substantial Tether ($USDT) thefts. Analysts connected 43 individual collector wallets through funding trails tracing back to a shared address used specifically to cover network transaction fees. While these on-chain financial links definitively establish an interconnected network, investigators note that unified control by a single entity or operator remains unproven.
Among the highlighted security breaches, TRONSCAN records show that a single transfer drained 519,093.330005 $USDT and routed the assets to a collector address designated as TEDjN on Oct. 25. To calculate the overall scale of $USDT losses, Bitquery tracked outbound transfers that fully depleted a victim address’s $USDT balance. In compiling the net loss metrics, the analysis strictly excluded swap payouts, internal wallet-to-wallet transfers circulating within the identified network, and unrecognized or unclassifiable sender addresses.
Surge in iOS Attacks Hits Trust Wallet and Uniswap Users
Parallel to the on-chain tracing, the Security Alliance (SEAL) documented a targeted wave of iPhone wallet compromises. Between Oct. 28 and Nov. 3, the collaborative defense entity logged six iOS wallet-compromise reports that yielded approximately $127,000 in cumulative losses. The breaches were reported across multiple Trust Wallet instances alongside a single Uniswap Wallet installation.
These mobile compromises mirror findings from specialized device-security analysts investigating malware designed to siphon assets from smartphones. Specifically, researchers established that P7 DarkSword—a specialized spyware strain—possesses advanced wallet-data harvesting capabilities and has successfully executed unauthorized cryptocurrency withdrawals directly from victim devices.
Malvertising and Exploit Kits Deliver DarkSword Spyware
The vector for these mobile infections was illuminated on Oct. 21, when mobile security firm iVerify and Report URI revealed how threat actors weaponized malicious online advertisements and abandoned analytics tracking tags. These compromised distribution channels delivered the sophisticated Coruna and DarkSword exploit frameworks to unpatched Apple iPhones. Notably, iVerify documented a real-world P7 infection delivered straight through an Instagram advertisement.
The threat surrounding DarkSword has been developing for months. Google Threat Intelligence Group released research on March 18 demonstrating that the DarkSword toolset had already been deployed by multiple distinct threat actors. In that report, Google urged iPhone users to keep their iOS versions up to date or utilize Apple’s Lockdown Mode if prompt patching was not feasible. Responding to the continuing attacks, Trust Wallet issued an advisory on Nov. 6 echoing these precautions, urging users to immediately install the newest available iOS updates and strictly avoid storing crypto seed phrases or private keys in device notes and screenshots.
Why This Matters
The convergence of advanced spyware distribution with rapid decentralized asset draining marks an escalating challenge for mobile-first Web3 adoption. By weaponizing mainstream distribution vectors—such as expired web tags and standard social media ads on platforms like Instagram—exploit kits like Coruna and DarkSword bypass conventional user skepticism. Furthermore, the reliance on automated collector networks demonstrates that modern threat groups have streamlined both device-level exploitation and on-chain liquidity laundering, heightening the urgency for mobile users to adhere to stringent hardware hygiene and isolation practices.
Frequently Asked Questions
What is the DarkSword (P7) malware and how does it compromise crypto wallets?
DarkSword, including its P7 variant, is an iOS-targeted spyware strain and exploit framework capable of harvesting sensitive wallet information directly from mobile devices. Discovered in multi-actor operations by Google Threat Intelligence Group and tracked by iVerify, it has been delivered via malicious online ads and expired analytics tags—including confirmed campaigns on Instagram—to exploit vulnerable iPhones and siphon digital assets.
Which cryptocurrency wallets were affected in the recent wave of iOS compromises?
Between Oct. 28 and Nov. 3, Security Alliance recorded six distinct compromises that depleted around $127,000 across multiple Trust Wallet users and one Uniswap Wallet user running on Apple’s iOS ecosystem.
What steps should iPhone crypto users take to protect their funds?
Security organizations and Trust Wallet recommend immediately updating iOS to the latest supported release, enabling iOS Lockdown Mode when system updates are delayed or unavailable, and ensuring private keys and recovery seed phrases are never saved digitally in screenshots, cloud backups, or notes apps.
