Software wallet
Trust Wallet
2017trustwallet.com ↗TWT market data →
Also known as Trust Wallet app, Trust: Crypto & Bitcoin Wallet, TWT, Trust Wallet Token
is trust wallet safe
Trust Wallet is self-custodial, so Binance, which has owned it since 2018, cannot move your funds. Its record is mixed: a 2018 iOS key-generation flaw that was exploited in 2023, a 2022 extension bug, and a December 2025 backdoored Chrome extension (v2.68) that drained about $8.5 million from 2,520 addresses. The mobile app was not affected by either extension incident.
Our read
Trust Wallet earns its place on chain coverage and a mobile app that more than 200 million people have installed. Its security history is weaker than that scale suggests, and the pattern matters: two of the three losses came through the browser extension, and in 2023 Binance denied a flaw researchers had matched to Trust Wallet addresses. Use the mobile app for everyday amounts, treat the extension as the riskier surface, and keep savings on a hardware wallet.
Key facts
- Installs / balances (company figures)
- 210M+ installs, over $30B in user balances, $1B+ monthly swap volume
- Sep 2025 · Trust Wallet ↗
- December 2025 extension incident
- v2.68 backdoored; ~$8.5M taken from 2,520 addresses; 5,000+ claims filed
- Jul 2026 · Trust Wallet ↗
- App Store listing
- "Trust: Crypto & Bitcoin Wallet", seller DApps Platform Software Services Ltd., first released 27 September 2017
- Sep 2026 · Apple ↗
Is Trust Wallet safe? The record since 2018
Trust Wallet is non-custodial: the recovery phrase is generated on your phone or in your browser, and neither Trust Wallet nor Binance can freeze or move what is in it. That also means nobody can reverse a bad transaction. The question is whether the software that generates and stores your keys has held up, and here the history has three real failures.
| When | What broke | Losses | Paid back? |
|---|---|---|---|
| Built Feb 2018, exploited 12 July 2023 | Early iOS builds seeded the recovery phrase from the device clock only | Over $3M across 2,112 addresses (researchers) | No; Binance disputed the link |
| Wallets made 14–23 Nov 2022, disclosed April 2023 | WebAssembly bug in Wallet Core weakened keys created in the browser extension | About $170K | Trust Wallet said it would refund |
| 24–26 Dec 2025 | Malicious extension v2.68 pushed to the Chrome Web Store with stolen credentials | About $8.5M from 2,520 addresses | Reimbursing in batches; verification still ongoing in July 2026 |
The 2023 case is the one to know about. Researchers from the Milk Sad team and SECBIT matched 1,756 of 2,112 drained addresses to wallets created by vulnerable Trust Wallet iOS code from 2018. Binance's reply, after five months, was that the incident was "unlikely to target Trust Wallet users" (SECBIT). NIST later catalogued it as CVE-2024-23660, noting it was "exploited in the wild in July 2023". If you created a Trust Wallet on an iPhone in 2018 and still use that phrase, move the funds to a new one.
None of the three touched the Android or iOS app as it ships today. Both extension incidents hit only people who created or opened wallets in the browser during a specific window.
The Trust Wallet browser extension and the v2.68 hack
On 24 December 2025 a version 2.68 of the Trust Wallet extension appeared on the Chrome Web Store without going through Trust Wallet's release process. It carried code in the extension's own analytics logic that sent wallet secrets out through the legitimate PostHog analytics library. Anyone who opened the extension and unlocked it between 24 and 26 December was exposed. Trust Wallet counts 2,520 drained addresses and about $8.5 million traced to 17 attacker wallets (Trust Wallet).
The root cause came from outside. Trust Wallet says the November 2025 Sha1-Hulud npm supply-chain worm exposed developer GitHub secrets, which gave the attacker the extension source and the Chrome Web Store API key (Halborn). The attacker did not need to break the wallet's cryptography, only to publish an update, and Chrome installed it automatically.
- Only extension v2.68 was malicious. Current listings are well past it (v26.39.3 on 25 September 2026), published by DApps Platform Software Services Ltd. with about 1 million users.
- If you unlocked the extension on 24–26 December 2025, treat that recovery phrase as burned even if the balance is still there. Create a new wallet and move everything.
- Reimbursement is voluntary and case-by-case. Trust Wallet received more than 5,000 claims for 2,520 addresses, many of them fraudulent, and set a 14 February 2026 filing deadline. Users who funded the wallet from Binance could verify through their Binance account.
What is Trust Wallet, and does Binance control it?
Trust Wallet is a multi-chain mobile wallet that Ukrainian developer Viktor Radchenko released in 2017; the iOS app went live on 27 September 2017. Binance bought it in July 2018, and Radchenko stepped down in 2022. Eowyn Chen runs it as CEO (Wikipedia). The app and extension are published by DApps Platform Software Services Ltd. Its key-handling library, Wallet Core, is open source under Apache 2.0 on GitHub; the apps themselves are not fully open.
Binance ownership does not give Binance your keys. It does mean Binance decides what code ships to more than 200 million installs, how incidents get disclosed, and what TWT is for. In September 2025 Trust Wallet repositioned TWT as a utility token for sponsored gas, fee discounts, premium features and access to token launches through "Trust Alpha", and set a target of one billion users by 2030 (Trust Wallet). TWT trades on its own market; see the TWT page.
| Item | Detail |
|---|---|
| Founded | 2017, Viktor Radchenko |
| Owner | Binance (since July 2018) |
| Publisher | DApps Platform Software Services Ltd. |
| Custody | Self-custodial; phrase stays on device |
| Open source | Wallet Core library (Apache 2.0); apps partly |
| Token | TWT, BNB Chain |
Trust Wallet scams and fake support numbers
More people search for "Trust Wallet customer service number" than for the extension, and that is where a lot of the theft happens. Help pages that rank for those searches, forum posts and paid ads list phone numbers and WhatsApp contacts run by scammers. The call ends with a request for the 12-word phrase or a "sync" link that asks for it.
- Trust Wallet's help lives at help.trustwallet.com (support.trustwallet.com redirects there) and inside the app. A phone number that is not listed on trustwallet.com is not Trust Wallet.
- No support agent, validator or "wallet recovery service" needs your recovery phrase. Anyone asking for it has already told you what they are.
- Fake token approvals are the other big one: an airdropped token with a website link that asks you to "claim" and sign an approval. Trust Wallet added scam-token filtering to search in May 2026, but it does not catch everything in your balance list.
- Cloned apps exist on unofficial Android stores. The real iOS listing is "Trust: Crypto & Bitcoin Wallet" with about 199,000 ratings.
Incident log
3 entries · $11.7M lost in total · repaid, confirmed: 0 of 3 where user funds were at stake
Hack$8.5M
Backdoored Chrome extension v2.68 drains 2,520 addresses
Using credentials exposed in the Sha1-Hulud npm supply-chain attack, an attacker published a malicious v2.68 of the Trust Wallet extension outside the normal release process. Users who unlocked it on 24–26 December 2025 had wallet secrets exfiltrated; about $8.5 million went to 17 attacker addresses.
Partly repaidTrust Wallet and Binance committed to reimburse; the first batch of verified claimants was paid in early 2026, but Trust Wallet's July 2026 update still describes verification as ongoing and case-by-case with no completion figure.Hack$3.0M
2018 iOS entropy flaw exploited (CVE-2024-23660)
Trust Wallet iOS builds from February to July 2018 generated recovery phrases using only the device time as entropy. On 12 July 2023 attackers swept 2,112 addresses; researchers matched 1,756 of them to vulnerable Trust Wallet code and put losses above $3 million across Ethereum, Bitcoin, BNB Chain, Arbitrum, Polygon and Optimism.
Not repaidBinance told researchers the incident was unlikely to target Trust Wallet users; no reimbursement programme was announced.Exploit$170K
Wallet Core WebAssembly bug in browser extension
A WebAssembly flaw in Wallet Core weakened addresses created in the Trust Wallet browser extension between 14 and 23 November 2022. Two exploits took about $170,000; about 500 vulnerable addresses still held $88,000 at disclosure.
Repaid — company's word onlyTrust Wallet announced refunds plus gas assistance for affected users; no independent tally of payouts found.
In our ratings
This page is the record. The scores sit on the review cards, next to the evidence and the weights they came from.
Compare Trust Wallet with
MetaMask (Consensys)Software wallet · 2016 · United StatesSelf-custodial Ethereum wallet built by Consensys since 2016, now also holding Solana and Bitcoin. A 2026 split turns it into a standalone company.
PhantomSoftware wallet · 2021 · United StatesSan Francisco self-custodial wallet that started on Solana in 2021 and now covers Ethereum, Base, Bitcoin and more; valued at $3B in January 2025.
Rabby (by DeBank)Software wallet · 2021 · SingaporeOpen-source EVM wallet from the DeBank team, launched in 2021, that simulates each transaction and shows the balance change before you sign.
BlueWalletSoftware wallet · 2018MIT-licensed, Bitcoin-only mobile wallet released in 2018, with multisig vaults and hardware-wallet signing; ended its custodial Lightning service in 2023.
Frequently asked questions
Is Trust Wallet a cold wallet?+
No. It is a hot wallet: keys live on an internet-connected phone or browser. It can connect to a Ledger for hardware signing, which is the way to keep larger balances offline.
Is Trust Wallet non-custodial?+
Yes. The recovery phrase is created and stored on your device, and neither Trust Wallet nor Binance can access or freeze the funds. Lose the phrase and nobody can restore it.
How do I withdraw from Trust Wallet to a bank account?+
Trust Wallet cannot pay out to a bank itself. Either use the in-app Sell option, which hands the trade to a third-party provider where your country is supported, or send the crypto to an exchange account and withdraw from there.
Was I affected by the December 2025 Trust Wallet hack?+
Only if you used browser extension v2.68 and unlocked it between 24 and 26 December 2025. Mobile app users were not affected. If you were, move funds to a newly created wallet even if nothing has gone yet.
Is Trust Wallet legit?+
Yes. It is a real product owned by Binance since 2018, published on the App Store since 2017. "Legit" is not the same as spotless: its security record includes three incidents with user losses since 2023.
What changed
- Profile published.
Compiled by
Blockchain Security Researcher · September 27, 2026
We have no commercial relationship with Trust Wallet and earn nothing from any link on this page. Every fact above carries the date it was true and a link to where it comes from; if one is out of date, the contact page reaches the editor who keeps this file.