Bitcoin Forum

I just found out that even if you open 100 ETH addresses using Metamask, once your key is been compromised all the 100 ETH addresses are gone, but in case of Trust wallet each addresses has different recovery seed ..

If you don't know this before you should know now, please take note, some people are using Metamask multiple wallet addresses and they don't understand the risk involved.

I haven't used trust wallet for ethereum but I assume it works the same as metamask in just using one address.

You use the same seed for everything in both. Trust wallet likely cycles through addresses you can use for most coins but everything depends on the one seed.

You can also add accounts/addresses to metamask and switch between them (either using the same seeds or different).

Ultimately this is a choice of coin though. Ethereum doesn't have built in and easy privacy functions like bitcoin and other networks do/enforce. Trust wallet has more coins than metamask and a greater compatibility with other networks but isn't open source so will always have a reliability concern.

A recovery seed and a private key are not the same thing. It is possible that this was just a typo, but it is important to clarify the distinction between these two terms.

A recovery seed, also known as a seed phrase or mnemonic phrase, is a series of words that are used to restore access to a cryptocurrency wallet. It is essentially a backup of your wallet and can be used to regain access to your funds if you lose your password or you accidentally delete your wallet.

On the other hand, a private key is a unique, secret code that is used to authorize transactions on the blockchain. And, as far as I know, each ETH address has its own unique private key.

It is important to keep both of these pieces of information secure and private, as anyone who has access to them could potentially gain access to your funds. But, it is also important to note that if you lose one private key, it will not compromise all other addresses of your wallet. Therefore, your statement above is incorrect.

I'm not into Ethereum or Metamask, but when you say key, do you perhaps mean "master private key"? If Metamask generates addresses deterministically (it most likely does, there has to be an Ethereum Improvement Proposal about that), then knowledge of the master private key will grant access to each address' private key.

That is not correct. Knowledge of the Trust wallet's seed phrase does grant you access to the entire wallet; not to just one address.

You have a point but do you know that Metamask is better than Trustwallet because is it completely open-source while Trust wallet is not even though they claim their wallet is open-source?
Meanwhile, the most important thing every cryptocurrency need to understand is the pro, and cons of using every crypto wallet they use to store their coins and they also need to avoid human error.

Stop giving your private keys or wallet seed to every tool asking for them. If you really really want to give out all that, make a special wallet only for that purpose and keep very small amount of funds on it. And yeah, pretty much count it as compromised.

Maybe also helps keeping the bulk of the coins on hardware wallet. It may make you think twice before you go looking for your seed backup because whatever software was asking for it.


Also, as already said, you should try to read about more and understand the words/terms you're using. Now you make a confusion and get corrected, no big deal. Tomorrow you make a confusion that leads to a mistake and you lose money, not good.

Metamask is not fully open source.

So can you answer few questions from the above users? it's seed phrase, master private key or each address private key? it's better for you to explain how it's work and why it can access to the whole wallet too.

Both Metamask and Trust Wallet is almost similar where it's contain same risk due to web wallet and closed source. Better to stick with hardware wallet and write the seed phrase in a strong material.

How exactly does that works? I have metamask wallet and each time I import my account using private key it only import one account so I don't quite get how it's possible for someone to get access to all my account when they only have the key to just one of my account. It sounds unreal.

He means in Metamask you can do multi accounts in just one seed phrase/private key. It is literally equal to just 1 owner.

In Trust Wallet, you can also do this in just one application but it's like each has one owner because another account will mean creating a new seed phrase that you need to save again in your physical notes to avoid hacking.

Once your Metamask is compromised or your seed phrase/private key was hacked then every account under it can be accessed by the hacker and steal all the balance you have.
https://i.imgur.com/TSRuMAe.png

Cause you are adding up addresses. But you can always make new wallet on metamask instead of adding a different address on your recovery key.

Trust wallet is the same in my opinion and Ive used both wallets. For me its much safe on metamask since trustwallet isnt fully open source.

The UI of trust is much user friendly than metamask but in terms of security I think I could vouch for metamask than trustwallet.

I know about that trust wallet own.
My concern is the metamask take a look at my account you can see "imported" there my question now is that will what is saying also affect account that was imported? Like if my private key should get stolen or what for whatever reason it got leaked will those imported account still be affected?
https://i.ibb.co/6015y9c/Screenshot-20221231-104147.jpg

The same risk either you use one of those wallet since even if you choose one of them but you are lazy on securing your wallet since you believe that no one will hack you then provably that is the time you get a problem. So any wallet you use make sure you save your private key or seedphrase away from people who want to stole it. Make sure to save those important information offline since this is safer option we can choose on.

The question is how did you get hacked? For example, if the hacker reaches the root access, he may be able to record the screen, send coins, or access the private key, and then even if you have a thousand accounts, they will all be hacked.

Multiple independent accounts are useful if the wallet file has been hacked one/one as each account will need to be brute force if you use a different password.
But if the device is hacked, all accounts will be hacked.

I don't think OP's statement is correct, because when you generate 2nd wallet from metamask, it will also give you a private key, and if hacker doesn't own it, nobody can access the second account. If you accidentally delete the metamask wallet and don't back up the private key of the 2nd wallet and only store the 1st wallet, you won't have access to your 2nd wallet either. They are still 2 separate wallets and have nothing to do with each other.

all software and browser wallets are not as reliable as we would like it to be. Metamask works very well with Ledger and Trezor hardware wallets. Your seed phrase must not be on the PC. A friend of mine was recently hacked, but he did not lose anything that was on hardware wallets.

Yeah, it's better to have most funds in a hardware wallet and that is because when someone accessed it without authorization, they're hardly get it because there's an authentication that shall go through with the device itself (hardware wallet) and without such access to the HW, they're unlikely to touch the funds that are kept there.
OP is just explaining that everyone can add as much as addresses as they can even in other networks under one seed phrase provided by Metamask.

For the most popular wallets in the world, most of the exploits are developed by hackers. If you store money on software wallets, you will still lose it as a result of inattention. A $70 hardware wallet protects against such threats. But if the user is inexperienced and uses unknown smart contracts, then even a hardware wallet will not help him.

What's wrong with the mindset of some of the people is, that they see $70 isn't an investment but an expensive buy.
They're holding a lot of tokens with thousands of value and they can't attain to buy hardware wallets or anyway of protecting themselves. Nothing wrong with having these free wallets that are giving the private keys and seed phrases.
But having a hardware wallet is another way of protecting our assets, they'll just start buying when they've experience such hacks.

But doesn't metamask store all those private keys behind the recovery phrase? I mean what would the point of the recovery phase of metamask be if you couldn't access to all your wallets you have opened in there. Naturally you can export and import accounts from and to metamask by private keys, but those privatekeys stay on your metamask until you remove them. Right?

That is not true. Trust Wallet does not use a different seed phrase or recovery phrase for every address. But the wallet has a wallet feature that can keep more than one single recovery phrase configuration, so you have "multiple wallets", I'm sure you are misunderstanding the features.

See the referred link below in regard to information about the differences between Private Key and Recovery Phrases, you should have comprehended it before spreading that information to others.
Private Key and Recovery Phrase. What’s the Difference? (https://community.trustwallet.com/t/private-key-and-recovery-phrase-whats-the-difference/3252)


Incorrect. Metamask is currently still fully open source, you can build your own MetaMask applications with the following source:

Extension: https://github.com/MetaMask/metamask-extension
Mobile application: https://github.com/MetaMask/metamask-mobile

This is misinformation. Getting one private key compromised doesn't affect other addresses generated from the same seed phrase. What you should never get compromise is the seed phrase as thousands of addresses that can be generated from that phrase becomes accessible by the one with the seed phrase.

Whatever you are doing, you should really protect your private keys at all cost because if you didn’t protect it, expect that hackers can easily get your hard earned money and your crypto. Multi-wallet in Trustwallet gives you another keys though every time you create one, you just have to understand it to avoid any confusion like this.

If you are talking about a private key, I do not think it will affect other addresses on the metamask if ever it got compromised.  I think it is the seed phrases that will affect all the address in the metamask if it is compromised.  Seed phrase is the door to all your eth address, it is the master key to all your addresses.


You can use Metamask and create a different account with different seed phrases to create unrelated wallet addresseses.  Just import them to the Metamask if you wanted to have access to each address created by different seed phrases.

Hackers or code technicians will figure out the logic of the wallet, because creators have the habit of leaving a back door in the design of various applications.

It's true that it's very important to protect private keys and I don't think anyone should ever know about that unless you really trust someone,
besides that we also have to be vigilant because hackers are getting smarter and have new ways

It's not even easy to protect it on your pc anymore, and even hardware wallets are attacked, even if they can't take it from you by force or hacking, they will use social hacking and make a project that looks real and potentially something that can make you rich, get you to invest and steal all the money and this is done daily, so you have to be always on the look out.

Simple solution is to buy strong and trusted coins and not invest into anything else and put it on your ledger and just take it out of your pc, put it somewhere safe in your room and hide it. If you do this, you are 100% protected, but everything else you do will make it harder.

Creating new wallet in metamask will generate new private key while trust wallet doesn't create private key but create a seed phrase. Using Trustwallet to create more than 12 wallets is not possible unless you use different devices. Currently, I have 11 wallets in Trustwallet where some of it are imported but when I try to create more it says You have reached the maximum number of created wallets 10. You cannot create more. I guess they put s limit on how many wallet doed s single device where Trustwallet is installed. In metamask is I am not sure rhe limit if there is.

In the Trustwallet wallet there is only one recovery method for all coins, namely prhase. If you create two wallets, of course you will get two recovery phrases. So, I haven't found what you said on Trustwallet. You can also import the Metamask phrase into Trustwallet and generate the same wallet address as Metamask, only you already have a wallet for coins.

Yes it's true that all Metamask Address has same paraphrase key. If any body get access to this phrase then your all fund can be stolen. Usually hacker use malicious software to get these data and we should be careful when install new software and should always acan with Trust antivirus. Trustwallet will give you feature of creating multiple accounts with different phrase. These phrase should be written in paper and never store in cloud file

He is actually pointing out to the phrase or seed phrase when he said recovery seed. You are also right there that there is only one way to access our wallet in trust wallet but in metamask I think there are different methods, including the old private keys or the one that has a lot text/letters, then there is also a 12 word seed phrase on it but the only downside of metamask is just like the op said, its not good when creating multiple wallets/addresses. Thanks for this thread anyway @OP.

I m not a newbie in cryptos anymore but I didn't knew this information yet. This is very helpful for everyone, especially to those who like to create multiple wallets to safeguard their main wallets from malicious acts.

Even using 100ETH wallet addresses but considering that it was of the same keys/password, hackers will simply get everything they found.
If we have accumulated a huge amount of ETH, it is better not to use a single account to keep them. Spreading them to several accounts helps them to keep safe and it is most preferred to use an offline wallet if we have money for higher security than just online wallets like Trust wallet or Metamask.

You do have different understanding about seed phrases and on what we called privatekey.

A certain seed phrase could contain tons of addresses which if you do have that phrase then you could access all the addresses enclosed to it.
The thing you do pertain about on that trustwallet is that you do able to get the private key of each address you see or available.
Private key and seed phrases is never been the same and you should at least know the differences of both.

I never look deep into that but what I know is that Metamask is open-source. When you said it is not fully open source. Does this mean something changed in their operation at some point? Does this happen when they migrate their open-source code under a new proprietary license?
Await your reply.

I don't think creating a hundred wallets would be ideal when in fact you can have a few and be mindful of your seed phrase. I've tried using both wallets before and I haven't encountered any problems so far. I think it all depends on how you keep your private keys safely so you can continuously access your online wallets. As much as possible, you should have a hard copy of your seed phrase so you won't have trouble in case you forget your access.

Yes, you are right. For each wallet you open in Trust wallet, you have a seed phrase, and you can open a maximum of 10 wallets per phone- from my own experience. For metamask, you open using the same seed phrase but I am not sure how many wallets is the maximum. But in all instances, the most important is to keep your seed phrase away from reach, and be careful not to give it out for whatever reason. Newbies should also note that if a hacker have access to your seed phrase, it renders the password useless. If you have the seed phrase, then you have complete access to the wallet.

I think there is FAQs on Metamask and Trustwallet before you create an account, and securing our secret seed phrase and private key is our own risk if we don't secure it properly. I think software wallet is much secure than using those add-ons wallet but the only difference is when doing a fast transaction.

what you say is clearly true, because when your metamask password is known then all addresses that you create and are in the metamask will be easily opened.
because each address will be easily opened by entering the export private key and when entering the password, Show Private Keys will open.

it's that easy until now and I don't know what way can be done to lock each address, but is this really the convenience provided by metamask and we really have to be able to protect passwords properly.

You have missed out on 1 distinct point; since i didn't notice a clear answer in that regard; i will address it here. There is a distinct feature between metamask and trust wallet.

• For MetaMask, the first wallet you create; you get a 12 word seed phrase, and for subsequent accounts you get a private key that controls each accounts
• For Trust Wallet, You can create up to 10 accounts; and for all 10 wallet accounts that you create; you get a distinct 12 different seed phrases for all 10 accounts

So please make sure, as you create more wallets on MetaMask, keep their private keys and store them securely too. Your Seed phrase = Your Money

Same scenario happened to me last year. That was when I was using Metamask. One wallet was hacked and from there all the others got hacked. I blame only myself

Maybe I also just found out about this. Because I mostly use trust wallet. because even now the trust wallet already provides a feature to add a new network. but I've also used Metamask. But not to create multiple wallets or multiple addresses. so I didn't realize about it. I think knowledge of this will be of little use to me. and so that I can be more careful.