# Thieves took about $4 million in USDT from active TRON wallets as CertiK warns of an updated DarkSword iPhone exploit kit

CryptoSlate mapped a theft network of 365 addresses and found that only one theft matches a publicly identified iPhone owner, so the link between these losses and iOS exploits depends on limited evidence.

- Published: 2026-11-07T05:47:17.298Z
- Canonical: https://polylog.news/crypto/2026-11-07/thieves-took-about-4-million-in-usdt-from-active-tron-wallet
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/zero-click-ios-exploits-drain-4m-usdt-from-active-tron-wallets/), [crypto.news](https://crypto.news/darksword-iphone-exploit-crypto-wallets-certik/), [ForkLog](https://forklog.com/en/news/google-uncovers-darksword-exploit-chain-targeting-iphones), [Macworld](https://macworld.com/article/3257479/darksword-and-coruna-ios-exploits-continue-to-attack-crypto-wallets.html), [SecurityLab](https://www.securitylab.ru/news/579701.php)

The blockchain security firm CertiK warned on November 6 that attackers are using a newer version of the DarkSword exploit kit to target crypto wallets on iPhones that have not been updated. According to CertiK, visiting a malicious Safari…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-11-07/thieves-took-about-4-million-in-usdt-from-active-tron-wallet (subscription information: https://polylog.news/pricing).