Trust Wallet has been hacked and users are losing their funds.

[KawasakiNinja1_]

A well-known wallet for us is the Trust Wallet, but currently during this festival we are seeing that it has been hacked. Initially I was surprised to see this news that Trust Wallet users lost 6 million plus dollars in a browser extension incident, it actually seems that their browser extension was not secure. This news spread within a few hours and it was mentioned that hundreds of “Trust Wallet” wallets were hacked in the last 2 hours. @TrustWallet Chrome extension is suspicious, so be careful using it.



Anyway here is what security researchers have observed by Trust Wallet extension and they mentioned that after closely examining this browser extension (marked as 4482.js) it was found that there was a newly added code in a JavaScript file but it was not explicitly linked to the release node and it seems that this may be the reason for their problem.


By the way finally I am going to add how much money people lost after this Trust Wallet was hacked.  It is clearly visible here that several users have publicly mentioned that this wallet gets hacked almost immediately after importing a seed phrase and the wallet starts emptying and it is mentioned that there has been a loss of around 700k dollars, so my small suggestion is that maybe it is better to move our assets from here.



See details here. Trust Wallet Warning! $6M+ Lost in BTC, ETH, and SOL via Browser Extension https://www.ccn.com/education/crypto/trust-wallet-warning-6m-lost-btc-eth-sol-browser-extension/

[Somegory]

Shame on Trust wallet because this isn't the first time that this happened, something that metamask don't just manage to do right, it was easy for them, I noticed that it's easier for crypto wallets to get issue when they decide to go browser extension, I guess there is something about browser extensions that makes them unsafe in general, I use trust wallet but never their extension because metamask seems to do that perfectly.

[BlackBoss_]

A well-known wallet for us is the Trust Wallet, but currently during this festival we are seeing that it has been hacked. Initially I was surprised to see this news that Trust Wallet users lost 6 million plus dollars in a browser extension incident, it actually seems that their browser extension was not secure.

There is no way to confirm that is a technical security issue from Trust wallet extension.

Users have many activities on their devices from computers to mobile devices and if their devices are affected, it's not responsibility of Trust wallet extension, and if their wallets compromised, fund stolen, it's user responsibility.

Generally, it's true to say Trust wallet is not a good one to use because it is close-source as you can see there
https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=Trust

[Charles-Tim]

Already existing topics: https://bitcointalk.org/index.php?topic=5569549.msg66217973#msg66217973

Op, it is best to lock this topic.

[TryNinja]

A well-known wallet for us is the Trust Wallet, but currently during this festival we are seeing that it has been hacked. Initially I was surprised to see this news that Trust Wallet users lost 6 million plus dollars in a browser extension incident, it actually seems that their browser extension was not secure.

There is no way to confirm that is a technical security issue from Trust wallet extension.

Nope, it's already confirmed. Someone already dig in the code to find an obviously malicious code that they somehow let slip in.

So here’s what’s happening  :

In the Trust Wallet browser extension code 4482.js
a recent update added hidden code that silently sends wallet data outside
It pretends to be analytics, but it tracks wallet activity and triggers when a seed phrase is imported
The data was sent to metrics-trustwallet[.]com  a domain registered days ago and now down

And here is Trust Wallet X account confirming it themselves:

https://x.com/TrustWallet/status/2004316503701958786

We’ve identified a security incident affecting Trust Wallet Browser Extension version 2.68 only. Users with Browser Extension 2.68 should disable and upgrade to 2.69.

[KawasakiNinja1_]

Already existing topics: https://bitcointalk.org/index.php?topic=5569549.msg66217973#msg66217973

Op, it is best to lick this topic.

Thanks for sharing this. Actually, I didn't know that this topic was created, in fact, juniors like me, members with lower ranks, probably don't know much about the thread in which it was created.

Wallet software, I first learned about this thread from you today.For now I want to leave it here because there are many new members who are still using Trust Wallet out of ignorance so those newbies should read this and be a little careful that this wallet is full of risks. Also, one of the reasons why I want to put it here is that beginners can easily navigate and find it in the Beginner and Help threads but beginners may not initially know or see the wallet softwarethread, so they can easily learn from it.

[Charles-Tim]

Wallet software, I first learned about this thread from you today.For now I want to leave it here because there are many new members who are still using Trust Wallet out of ignorance so those newbies should read this and be a little careful that this wallet is full of risks. Also, one of the reasons why I want to put it here is that beginners can easily navigate and find it in the Beginner and Help threads but beginners may not initially know or see the wallet softwarethread, so they can easily learn from it.

Okay, I will not report it. But newbies should make this as an excuse. At least, try and visit such important boards as they can really help.

This is not the first time that vulnerability was detected in Trust wallet browser extension and maybe this may not be the last one. Just avoid using browser extension as wallet and also avoid using close source wallets just as I have posted on the other thread.

[KawasakiNinja1_]

Wallet software, I first learned about this thread from you today.For now I want to leave it here because there are many new members who are still using Trust Wallet out of ignorance so those newbies should read this and be a little careful that this wallet is full of risks. Also, one of the reasons why I want to put it here is that beginners can easily navigate and find it in the Beginner and Help threads but beginners may not initially know or see the wallet softwarethread, so they can easily learn from it.

Okay, I will not report it. But newbies should make this as an excuse. At least, try and visit such important boards as they can really help.

Thanks again,Actually, I'm not taking this as an excuse because I never knew there was a special thread about wallet software, although I didn't search for it. It's nice to learn about new things. For now, it's another way to gain knowledge.

This is not the first time that vulnerability was detected in Trust wallet browser extension and maybe this may not be the last one. Just avoid using browser extension as wallet and also avoid using close source wallets just as I have posted on the other thread.

Yes, this is what we should try to learn because using such wallets is like putting everyone's crypto assets at risk because they can easily deceive users, which we have already seen here because many people have been deceived within a few hours using this wallet.

[cryptoaddictchie]

This incident highlights how browser wallet extensions can become a single point of failure, especially when unauthorized or poorly reviewed code changes slip into releases. That's how close source worked. Even trusted brands aren’t immune, so users should be cautious about importing seed phrases into extensions and consider using hardware wallets or moving funds until a clear post mortem and fix are confirmed. Ultimately, convenience should never come at the cost of private key security. Plus this isnt the first time trust wallet will get compromised. I remember them last time also got caught.

[aylabadia05]

Your wallet is indeed well-known, so many people I meet strongly defend the statements and comments made regarding Trust Wallet, saying that it is not a good wallet and should be avoided.
I didn't read the entire OP because from the title and part of the content, I can tell that Trust Wallet was hacked and many users lost their funds.

Who is responsible for this hack? 
Is there still anyone defending Trust Wallet when I say it should be avoided? 
There are other wallets more suitable for use if users want a wallet that supports more than one coin, such as Unstoppable.

[ultrloa]

Your wallet is indeed well-known, so many people I meet strongly defend the statements and comments made regarding Trust Wallet, saying that it is not a good wallet and should be avoided.
I didn't read the entire OP because from the title and part of the content, I can tell that Trust Wallet was hacked and many users lost their funds.

Who is responsible for this hack?  
Is there still anyone defending Trust Wallet when I say it should be avoided?  
There are other wallets more suitable for use if users want a wallet that supports more than one coin, such as Unstoppable.

CZ already issues a statement about the recent hacking issue happen earlier, there's good information to read in this site Binance’s CZ Says Trust Wallet Will Refund $7M After Security Hack, Points To Possible Insider Job

Although he guarantee that all affected user will get refund still its crazy to know that a supposed to be good wallet has been hacked.  Good that I decide not to click the update and maybe if I do that before I also suffer from this hacking issues. Will pull out some of my funds on my wallet and try to avoid this wallet for awhile.

[Zigabel]

Really sad to hear that trust wallet gets to suffer another compromise again, this had happened in the past and as after then they did gave the assurance about their security but it is sad to see now that they still got their security architecture compromised again, the trust in their name may have to change this time because they are gradually beginning to give customers reasons not to trust them as much with storage of their assets. other storage platforms will want to cease this opportunity to show trust to people who suffered some losses due to this compromise so they change to using their platforms and obviously Trust wallet will be loosing some investors and persons who uses their wallet at this time due to this incidence.

[TechGr8]

Your wallet is indeed well-known, so many people I meet strongly defend the statements and comments made regarding Trust Wallet, saying that it is not a good wallet and should be avoided.
I didn't read the entire OP because from the title and part of the content, I can tell that Trust Wallet was hacked and many users lost their funds.

Who is responsible for this hack? 
Is there still anyone defending Trust Wallet when I say it should be avoided? 
There are other wallets more suitable for use if users want a wallet that supports more than one coin, such as Unstoppable.

I’ve had an ugly experience with my assets in Trustwallet too… I’d appreciate better recommendations over TrustWallet cause I’ve had serious concerns since that incident. It can really raise a serious panic for one to observe His assets in His/Her bitcoin wallet disappear. I mean, so much psychology goes into that first instant shock. I hope to be safer and want to opt from Trustwallet for awhile…

[Vvang]

Trust wallet was created to become a hot wallet running on smartphones, not as an extension.
Metamask was created to be an extension for browsers from the beginning.

One shouldn't have left its purpose of been created to match other wallets, I believe this is the problem here, Trust wallet devs never prepared for what's coming, they should have just look into metamask security more and compare to what they have, if one in broken it should affect other wallets that are browser extensions too but in this case its just Trust wallet.

They should have just stayed a hot wallet.

[goldkingcoiner]

It would not surprise me if this was an insider and not a hacker.
Trustwallet is shady AF.

They do not give a shit about protecting their users.
Their UI has been completely unsafe for years. Their entire app is closed source.

[Faisal2202]

There is no way to confirm that is a technical security issue from Trust wallet extension.

Users have many activities on their devices from computers to mobile devices and if their devices are affected, it's not responsibility of Trust wallet extension, and if their wallets compromised, fund stolen, it's user responsibility.

Generally, it's true to say Trust wallet is not a good one to use because it is close-source as you can see there
https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=Trust

It was an inside job according to CZ, because someone pushed that new update that caused all this and no way someone from outside has done it, so if CZ has mentioned that, then probably they are going to cath the person responsible, or to cover their ass they can lie that someone from the team was an intern haha like as usual and mistakenly published to the web store.

Anyway it will get solved later, but he even mentioned about compensation so let's see if they pay the victims back.

It is really not good to use, especially the extensions, I always tried to avoid extensions, but I have to confirm I have used tw on smartphone.

[joniboini]

It was an inside job according to CZ, because someone pushed that new update that caused all this and no way someone from outside has done it, so if CZ has mentioned that, then probably they are going to cath the person responsible

Does CZ still have power on Binance and its business? I'm surprised he's that open about it. Not to mention, we have had many supply chain attacks in the last few months or so, I thought they'd blame that. Curious how they'll determine which wallet is hacked or not.

[SuperBitMan]

What is this how can they be this careless, one of the reasons why you see this hacker succeed in hacking some wallet and exchange is because of the carelessness of the wallet or exchange they don't have competent hand that we handle their security issue and that is why you see it always been hacked. Sometimes I believe this hack is not something that is done by an outsider it can be that trust wallet is doing all this and then claiming it was hacked because I don't understand, this is not the first time I'm hearing about trust wallet being hacked if something has happened to you the first time why not take preventive measures to stop it from happening again, I believe if they do a very good investigation they will discover that trust wallet management is part of this.

[Patikno]

I recommend that anyone who has ever used the TrustWallet extension immediately transfer their crypto assets to a new wallet address. Never use the same wallet you previously used with that version of TrustWallet.

Here are some things I think you should do, especially if you are using this version of the extension.

1. Move your assets to a new wallet, or one you feel is secure and that has never been connected to this version of the TrustWallet extension.
2. Delete your browser extension.
3. If possible, completely uninstall the browser where the extension was installed (make sure the browser registry files are also deleted).
4. Reinstall your browser and use the latest version of your extension.
5. Try never to use any wallet you have used with TrustWallet version 2.68.

This advice may seem excessive, but I believe it is necessary to avoid any potential risks. Who knows, maybe your browser is also infected with a threat? So, I think you should reinstall your browser.