Trust wallet compromises

[Karl_3000]

The forum is not the only place to learn about Bitcoin, Bitcoin wallets, and cryptocurrency wallets. You are too exaggerating the importance and role of Bitcoin forum in educating people about different wallet types.

Where did I say that this forum is the only place to learn about bitcoin, bitcoin wallets and cryptocurrencies? It should not be hard for you to understand what I mean. What I meant was that the chance that people will know about opened source and close source wallets is high on this forum. Despite that I know what self-custody wallets are before I registered on this forum, I did not know what open and close source wallets are. This forum expose us to many information that we might not find out on our own.

[BitMaxz]

Where did I say that this forum is the only place to learn about bitcoin, bitcoin wallets and cryptocurrencies? It should not be hard for you to understand what I mean. What I meant was that the chance that people will know about opened source and close source wallets is high on this forum. Despite that I know what self-custody wallets are before I registered on this forum, I did not know what open and close source wallets are. This forum expose us to many information that we might not find out on our own.

That's the nature of the forum; even in other forums, not everyone has skills in deep research. I know it's hard to find some resource and knowledge by just using the google search engine. Unlike here on the forum, you can make a thread and ask everyone what is this and that are.
That's the purpose of the forum: to discuss something that we don't know or to contribute to the community.

About the wallet, custodial or non-custodial (self-custody), if this is just what you know, not all self-custody wallets are open-sourced. That is why someone here is pointing to an open-source wallet.

One of the non-custodial, or self-custody, wallets is Exodus Wallet, which is closed source; it is not a recommended wallet or a hardware wallet like Ledger Nano.
How can you make sure they don't add something to their wallet even if they say we have full control? Do you think you are safe with these wallets if you don't know and verify the open source?

Having self-custody wallet isn't enough; you still need to know what it means to have self-custody it's either open/closed source.

[aylabadia05]

I’d suggest not using the Trust Wallet browser extension to send BTC to another wallet. Instead, import the seed phrase from Trust Wallet into another wallet like Electrum. After that, send your BTC to a different Electrum address (with a new seed phrase), and avoid using the old Trust Wallet seed phrase again to prevent any unwanted issues.

Good ideas, never opening yet the trustwallet extension any more and paste seed phrase at other platform wallet then moving fund to electrum wallet.

That is indeed the solution, as Husna QA mentioned, importing seed phrases from Trust Wallet to recommended wallets such as Electrum or BlueWallet. From wallets such as Electrum or BlueWallet, send assets to a different address. I experienced the same thing when using Trust Wallet before using BlueWallet. It was exactly as she said, which is what I did to save my assets.
Or perhaps you're still using Trust Wallet to this day. If not, that's good for you.

[Mpamaegbu]

I will advise you not to use Trust wallet anymore because it's a closed source wallet and one of the worst wallet I have come across so far. It's better that you create an electrum wallet and transfer your funds into it for the safety of your funds.

Electrum is a Bitcoin wallet while Trust Wallet is a crypto wallet. Electrum can't hodl any other coin that isn't Bitcoin (at least, that's my observation). We don't know what OP was hodling in Trust Wallet. Maybe it wasn't even Bitcoin. So, getting an Electrum wallet won't work for them.

OP, I have installed in my smartphone Trust Wallet's App to hold small amounts and I have not received any warning message nor I haven't lost funds either, now that I've just checked it, so chances are that the problem is only with the browser extension.

I haven't lost funds too using Trust Wallet. I don't also like using wallets in browser extension because I believe they're porous and easy to hacks there.

[Joy_learns_crypto]

The browser extension of trust wallet was compromised last week and almost 7$ million was lost, read this posts for more info..https://bitcointalk.org/index.php?topic=5569565.0  or  https://bitcointalk.org/index.php?topic=5569549.msg66217973#msg66217973

If you have browser extension of trust wallet then you should open another wallet and move your funds.

Rather than opening another trust wallet after trust wallet was compromised and $7 million was lost I think I would stop using trust wallet for now, if the op was lucky not to have lost any funds from $7million which was lost it is time to use another wallet.
Trust wallet will lose more funds next time because the wallet is safe.

[Jewan420]

The browser extension of trust wallet was compromised last week and almost 7$ million was lost, read this posts for more info..https://bitcointalk.org/index.php?topic=5569565.0  or  https://bitcointalk.org/index.php?topic=5569549.msg66217973#msg66217973

If you have browser extension of trust wallet then you should open another wallet and move your funds.

Rather than opening another trust wallet after trust wallet was compromised and $7 million was lost I think I would stop using trust wallet for now, if the op was lucky not to have lost any funds from $7million which was lost it is time to use another wallet.
Trust wallet will lose more funds next time because the wallet is safe.

I am very worried about using Trust Wallet, I have some funds stored in my wallet which are somewhat valuable. This has now created a situation that has forced me to look for an alternative to Trust Wallet. I have already decided to migrate to Electrum Wallet and am preparing to transfer the funds as well. Because I do not like to take risks in financial matters especially when I have easy alternatives. Trust Wallet is now a completely risky extension or application either. I think it would be wise to leave Trust Wallet now.

[goldkingcoiner]

Hey community,

I received this notification on my phone immediately I received my signature campaign payout. I don't want to get nervous since my seed phrase is intact and hasn't been given to anyone else.



Do anyone knows what this message means and what should I do if it actually true.

If this post is not in the right board, please do lmk. Thanks.

I would not trust Trustwallet.
I lost around $6000 USD because of their shitty, faulty app.

This newest hacking development is no surprise. And I would not be surprised if it was an insider job.

They do not want anyone to notice their incompetence and shadiness. No wonder their wallet is closed source. (never use closed source or custodial wallets)

[lovesmayfamilis]

An update was released yesterday, and the wallet developers explained why their extension was hacked. The cause turned out to be the Shai-Hulud worm.

https://hackmag.com/news/trust-wallet-post-mortem

The developers of the popular crypto wallet Trust Wallet have linked the December compromise of their Chrome extension to the large-scale Shai-Hulud malicious campaign, which had already affected the npm ecosystem back in November 2025. The worm attacks compromised more than 800 packages, with thousands of developers around the world falling victim.

At the end of December 2025, the Trust Wallet browser extension was compromised. As it turned out, the issue was linked to version 2.68, released on December 24 — it turned out to be malicious.

The attackers added a malicious file to this version of the extension that stole confidential wallet data, enabling unauthorized transactions. As a result of the incident investigation, 2,520 victim wallet addresses were identified, and the total value of the stolen assets is estimated at $8.5 million.

As explained by Trust Wallet representatives, the hack became possible because one of the developers’ GitHub accounts was compromised during the attack, which gave the hackers access to the browser extension’s source code and the Chrome Web Store API key.

After gaining full access to the CWS API via the stolen key, the attackers were able to upload builds directly to the extension store, bypassing Trust Wallet’s standard release process, which requires internal approval and manual review.

At the next stage, the hackers registered the domain metrics-trustwallet[.]com and the subdomain api.metrics-trustwallet[.]com to host malicious code. Later, the infected extension version used them.

“With a high degree of confidence, we assume that the extension incident was linked to the large-scale Sha1-Hulud attack in November. We believe this allowed the attackers to gain access to the browser extension’s source code and the Chrome Web Store API key. Using this access, they managed to prepare a modified version of the extension with a backdoor designed to collect sensitive wallet data from users, and to release the malicious version to the Chrome Web Store using the leaked API key (CWS),” the developers reported.

Trust Wallet has already begun compensating affected users for their losses. At the same time, the company has warned that attackers may currently be impersonating Trust Wallet support and sending users fake compensation claim forms, as well as promoting this scam via Telegram.

Recall that the Shai-Hulud worm (also known as Sha1-Hulud) is responsible for a large-scale supply chain attack targeting npm.

In early September, during the first wave of Shai-Hulud, hackers compromised more than 180 npm packages using a self-propagating payload. With it, they stole developers’ secrets and API keys (using the TruffleHog tool for this).

The second wave of attacks was larger in scale and affected more than 800 packages. The attackers added over 27,000 malicious packages to npm, which used malware to collect secrets from developers and CI/CD systems, and then published the harvested data on GitHub.

According to researchers’ estimates, Shai-Hulud has exposed around 400,000 secrets in total and published the stolen data in more than 30,000 repositories on GitHub.

[Marvelockg]

The browser extension of trust wallet was compromised last week and almost 7$ million was lost, read this posts for more info..https://bitcointalk.org/index.php?topic=5569565.0  or  https://bitcointalk.org/index.php?topic=5569549.msg66217973#msg66217973

If you have browser extension of trust wallet then you should open another wallet and move your funds.

Rather than opening another trust wallet after trust wallet was compromised and $7 million was lost I think I would stop using trust wallet for now, if the op was lucky not to have lost any funds from $7million which was lost it is time to use another wallet.
Trust wallet will lose more funds next time because the wallet is safe.

Well, when it comes to a wallet being compromised, you can't be too sure that the particular wallet you're switching to is completely void of any sort of compromises. The only thing you have to do is to ensure that you're not keeping too much fund in an exchange regardless of how it appears to be safe in the short term. There's a great risk that's associated with leaving funds in an exchange and that risk is applicable to all the other exchanges. Today, it's trust wallet and another time you discover that it's bybit, bitget or something else. The surest protection that safeguards you is to ensure that your asset is kept in a non custodial wallet.

[satscraper]

The browser extension of trust wallet was compromised last week and almost 7$ million was lost, read this posts for more info..https://bitcointalk.org/index.php?topic=5569565.0  or  https://bitcointalk.org/index.php?topic=5569549.msg66217973#msg66217973

If you have browser extension of trust wallet then you should open another wallet and move your funds.

Rather than opening another trust wallet after trust wallet was compromised and $7 million was lost I think I would stop using trust wallet for now, if the op was lucky not to have lost any funds from $7million which was lost it is time to use another wallet.
Trust wallet will lose more funds next time because the wallet is safe.

Well, when it comes to a wallet being compromised, you can't be too sure that the particular wallet you're switching to is completely void of any sort of compromises.

But you can switch to multisig wallet, choosing for example the simplest two‑of‑three setup.

The probability of two signers in your quorum being compromised simultaneously is lower than the probability of any single signer being compromised.

The larger the quorum and the more signatures required, the lower the chance that the entire multisig setup can be compromised.

[Hazink]

I am very worried about using Trust Wallet, I have some funds stored in my wallet which are somewhat valuable. This has now created a situation that has forced me to look for an alternative to Trust Wallet. I have already decided to migrate to Electrum Wallet and am preparing to transfer the funds as well. Because I do not like to take risks in financial matters especially when I have easy alternatives. Trust Wallet is now a completely risky extension or application either. I think it would be wise to leave Trust Wallet now.

Many people that I know are just using the trust wallet because of the multiple coin features which it has. If not, it has never been among the recommended wallets for bitcoin before, and even for altcoins, we have Metamask and Unstoppable wallet as an option, and while you try to move your coins out, don't just use the wallet migration feature, where you will import your phrase to another wallet try to create a total different new wallet on the new open source self custody wallet and transfer your coins over there.

[Pablo-wood]

Many people that I know are just using the trust wallet because of the multiple coin features which it has. If not, it has never been among the recommended wallets for bitcoin before, and even for altcoins, we have Metamask and Unstoppable wallet as an option, and while you try to move your coins out, don't just use the wallet migration feature, where you will import your phrase to another wallet try to create a total different new wallet on the new open source self custody wallet and transfer your coins over there.

Sticking to recommended open source wallets costs users nothing rather it reduces  risk and ensures security of our coins. Each coin has wallets that are built and well reviewed by their various communities so I see no need in forcing everything into one wallet.

For instance Bitcoin can be stored in Blue wallet, Specter or electrum wallet which are all open source and for altcoins and tokens MetaMask perfectly serves the purpose.