WARNING: Potential Trust Wallet attack/exploit

[suzanne5223]

I'm not sure about who owns Trust Wallet nowadays. I might be wrong, but I think they were once owned by Binance? So it's probably fine for them to fully reimbuse the users.

Yes, and here's CZ's recent tweet, https://x.com/i/status/2004397190819783013
it seems he still cares, which means TWT still belongs to Binance.

Recovery of some assets will likely be executed in their classic way like when Binance was hacked (unless the hacker voluntarily returns everything stolen).

So the hackers had to replace the real trust wallet extension with a new one and the team are not aware? This is very hard to believe, I will wait for a better explanation from CZ himself because I have my trust issues with hacks like this, funds are safu like they said and reimbursing all lost funds is what Binance is known for.

Yet the October 10th theft on liquidity was a different one, quarter of lost funds are reimbursed not all of it, there are still things that have no good explanation to why they happened in this space, this days I don't even trust anyone.

What if Trust wallet carried out this attack by themselves to look like a saviour? A perfect way to win the heart of people even more, many will swim to Binance and trust wallet, this is just a day.

Anything can happen when the cryptographic keys used to create a wallet are vulnerable to brute force attacks, especially when the vulnerability was announced weeks ago, after the US government used the vulnerability to confiscate some BTC from an online theft called Prince Group's operation, and others.
Funny enough, the vulnerability of this wallet was announced to the public on X, formely know as Twitter, by F2Pool & Cobo co-founder Shenyu, but the Trust wallet team chose to ignore it.

[TryNinja]

What if Trust wallet carried out this attack by themselves to look like a saviour? A perfect way to win the heart of people even more, many will swim to Binance and trust wallet, this is just a day.

So they destroyed their reputation and made themselves look like morons by letting a malicious update slip through, just to attempt to "look like a saviour"? I'm not too sure about that.

Anything can happen when the cryptographic keys used to create a wallet are vulnerable to brute force attacks, especially when the vulnerability was announced weeks ago, after the US government used the vulnerability to confiscate some BTC from an online theft called Prince Group's operation, and others.
Funny enough, the vulnerability of this wallet was announced to the public on X, formely know as Twitter, by F2Pool & Cobo co-founder Shenyu, but the Trust wallet team chose to ignore it.

This is completely unrelated to this attack. You should read the topic before commenting.

[Botnake]

Looks like this isn’t a big problem after all, since once again it’s SAFU.

It's unclear whether Binance will utilize SAFU, given that its funding source is solely derived from Binance's customer activitym not TWT. Furthermore, TWT was developed separately, and this hack has no direct impact on Binance.

This is what is written int he tweet ; " @TrustWallet will cover. User funds are SAFU"
So i think we can assume that they will cover the loss since its just $7 million, just peanuts for them, compared to losing the reputation and no one would use the app anymore.

You must be careful using this wallet, because it is very vulnerable especially since there have been exploitation incidents.
You may not use version 2.68 because this version is affected by their asset drain.

I just open the wallet again, and I see the prompt, they want me to update.. Thanks

[satscraper]

So they destroyed their reputation and made themselves look like morons by letting a malicious update slip through,

It looks like their Chrome developer account was compromised, allowing hackers to inject the malicious JavaScript file into the extension build. In my view this may have been caused by negligence or sloppiness among the people who had access to that account. The positive sign is that the company acknowledged what happened and, to redeem themselves, has promised to refund the affected users.

[Pmalek]

Trust Wallet has always been an untrustworthy wallet. It's popular due to its wide altcoin support and because of the connection to CZ and Binance. It's convenient and easy to use, but security is at the bottom of their priority list. Their users forget that the software has had security incidents in the past, but because Binance has deep pockets, they can easily compensate the affected victims and look good in public. Once they refuse to cover the losses, all hell will break loss.

[Lucius]

What if Trust wallet carried out this attack by themselves to look like a saviour? A perfect way to win the heart of people even more, many will swim to Binance and trust wallet, this is just a day.

So they destroyed their reputation and made themselves look like morons by letting a malicious update slip through, just to attempt to "look like a saviour"? I'm not too sure about that.
~snip~

I presented a similar theory on another forum, and it doesn't seem strange at all if we think about all the methods of promotion that are used today. The most important thing about this whole story is that the funds are SAFU, and we all know which CEX is behind it. If we remember what their shadow boss says about cryptocurrency users, then the planned internal job is not such an incredible option. Ultimately, who is the hero in this story?

[NotATether]

Just imagine keeping $700k. in one wallet. Hasn't he heard of risk diversification? Hasn't he heard of hardware wallets, or at least storing them in a cold wallet on the desktop version, not in a browser extension.

I do not trust "Hawk Tuah" to even correctly state the bitcoin price for the day.

That being said, look at how Trust Wallet handled it at first:

As of now, there has been no official communication from the Trust Wallet team regarding this incident.

Sounds like an insider job from Binance, who owns Trust Wallet, otherwise they would've quickly issued a statement as soon as they found out.

Something stinks at Binance lately. First the BTC/USD1 pair crashing, now this. It certainly looks like they are resorting to fraud to keep their books balanced and they should be avoided if you can help it!

(Yes, I know about the compromised developer account. But how can such a large software be handled so sloppily? It just doesn't add up.)

[ozgr]

If these reports are true, the situation is really serious.
The compromise of chrome developer accounts is a major amateur mistake.
Trustwallet said it would cover the losses and that all funds are secure, but they lost their credibility.

[nc50lc]

(Yes, I know about the compromised developer account. But how can such a large software be handled so sloppily? It just doesn't add up.)

This also got me thinking...
Perhaps a damage control (reputation-wise) where it's less damaging to point the failure to a single culprit
rather than being blamed for negligence of their entire development team.

The initial unconfirmed reports that it might have been caused by the recent "supply-chain attack" sounds more plausible to me.
But who are us to judge, they've already officially posted it so let's just take it with a grain of salt.

[Brown Wolf]

If these reports are true, the situation is really serious.
The compromise of chrome developer accounts is a major amateur mistake.
Trustwallet said it would cover the losses and that all funds are secure, but they lost their credibility.

Yes. The reports are accurate.
They even urged affected customers to complete a form on their support desk so that they can proceed with the refund.
However, once you lose credibility, the customers will have a hard time believing in your service. I am concerned that the scammers will scam the victim again by providing a fake form and manipulating them to connect their wallet to malicious websites.

[BlackHatCoiner]

I've yet to see a bitcoin wallet worse than Trust Wallet. This thing is just so bad, and it probably has the worst history of wallet software in the history of bitcoin. It's closed source, sold by Binance. This is like blinding trusting the shitcoin Chinese shiller who went into prison with the custody and security of your funds. It must have got hacked... how many times already? Four at least.

At this point, it might be better to just use Binance instead of this clown software. At least if Binance gets hacked, you might get your money back, lol.

[Lucius]

~snip~
At this point, it might be better to just use Binance instead of this clown software. At least if Binance gets hacked, you might get your money back, lol.

The so-called hacking of TW seems to have exactly such an effect on the users who use it. This idea is not new, but has been promoted for years, and the goal is to ensure liquidity on CEXs. There is a link in my previous post that is more than enough proof that I am right.

[Pmalek]

Yes. The reports are accurate.
They even urged affected customers to complete a form on their support desk so that they can proceed with the refund.
However, once you lose credibility, the customers will have a hard time believing in your service.

I think you have too high of an opinion of the average crypto owner. Most of them are not going to change. Some surely will. As long as they get compensated by Binance and maybe even earn some extra shitcoins for their troubles, they will stick with what they are familiar with. And that is Trust Wallet. This isn't the first Trust Wallet/Binance security incident and I doubt that it will be the last.

[NotATether]

I've yet to see a bitcoin wallet worse than Trust Wallet. This thing is just so bad, and it probably has the worst history of wallet software in the history of bitcoin. It's closed source, sold by Binance. This is like blinding trusting the shitcoin Chinese shiller who went into prison with the custody and security of your funds. It must have got hacked... how many times already? Four at least.

At this point, it might be better to just use Binance instead of this clown software. At least if Binance gets hacked, you might get your money back, lol.

Hacked is a bit naive. More like your Binance account getting frozen for "AML compliance".

They should just call it Clown Wallet at this point.

The so-called hacking of TW seems to have exactly such an effect on the users who use it. This idea is not new, but has been promoted for years, and the goal is to ensure liquidity on CEXs. There is a link in my previous post that is more than enough proof that I am right.

If they need to resort to financial terrorism to maintain liquidity on their platforms, then maybe that's not an exchange you'd feel safe keeping your money in in the first place.

[Lucius]

~snip~
If they need to resort to financial terrorism to maintain liquidity on their platforms, then maybe that's not an exchange you'd feel safe keeping your money in in the first place.

No one should use CEXs as storage for their cryptocurrencies, but some analyses suggest that CEXs hold millions of BTC, although that number has reportedly decreased considerably over the years. Let us recall how evidence has emerged in the past that employees of the CEX in question were helping new clients bypass KYC, as well as the fact that many proceedings have been initiated against this company around the world.

If it turns out to be true that they hack themselves for whatever reason, no one should be too surprised given the history they have behind them.