Trust Wallet users are being drained, with $5.1M stolen so far!

[Rikafip]

Fair question, I think some folks used old iphones as a hardware wallet to store their crypto.

And then using Trust wallet in order to store that crypto? Doesn't make much sense to me, but people tend to do all kind of stupid stuff.

They didn't refund my stolen funds, when version 2.68 exploit happened and I swear to god not to use that wallet anymore.

How that exactly happened? If you are willing to share the story ofc.

[joniboini]

And then using Trust wallet in order to store that crypto? Doesn't make much sense to me, but people tend to do all kind of stupid stuff.

I can only imagine they have various alts, don't want to deal with a dedicated wallet for each of them, too lazy to find other multi-currency wallets when they used Trust Wallet already, and so on. A single instance of carelessness can cause thing like this to happen.

[Zwei]

i read that trust wallet were keeping seed phrases in raw plaintext RAM, if that's true, then they are also to blame.

I'd like to read it, do you remember where you read this?
A link to the article/news would be great.

i read that a while ago on twitter, but i can't seem to find the tweet with the details anymore. sorry 

Because depending on the context, it might just be a normal operation of decrypting the secrets (thus, will be saved in RAM for a few milliseconds) to be able to sign transactions, etc.
Or if it's something stupid, like keeping it plaintext in memory during the whole operation, then it doesn't need a compromised OS to be vulnerable.

i think it was something like that, if my memory is not failing me, the seed phrase was kept in plaintext cached in memory while the wallet was unlocked.
but maybe that issue isn't related to this drain, as it seems they fixed it a few months ago: https://github.com/trustwallet/wallet-core/pull/4615 https://github.com/trustwallet/wallet-core/pull/4667

you know this stuff better than me, so please correct me if i'm wrong.

[ultrloa]

They didn't refund my stolen funds, when version 2.68 exploit happened and I swear to god not to use that wallet anymore.

How that exactly happened? If you are willing to share the story ofc.

Due to this incident happened on their chrome extension before https://trustwallet.com/blog/company/trust-wallet-browser-extension-v268-incident-community-update

Then keep following up my case and this is last response I got from them.





And I give up and move on, until now didn't hear anything from them.

So avoid using Trust wallet guys.

[stompix]

Fair question, I think some folks used old iphones as a hardware wallet to store their crypto.
With this new hardware wallet hacks/leaks people who were considering using old iphones to store crypto should rethink again.

The vulnerability has been known for months, this is nothing new, the first major DarkSword spread happened 6 months ago and there is a patch for that for every iPhone since April!
Now, unless you go and download stupid things from shady websites or you open attachments you received from strangers in you emails, you're safe.
Somebody who uses this strictly a hardware wallet and not for day-to-day phone browsing, everything is safe.

CMIIW, but even if the iOS is exploited, shouldn't the wallet data remain secure, assuming it's encrypted with user PIN or password?

Not really, depends how that data is stored:
https://slowmist.medium.com/threat-intelligence-analysis-of-the-darksword-trojan-backend-and-ios-attack-chain-397ecf499fa8

Its capabilities range from routine collection of camera, microphone, photo library, contacts, SMS, Wi-Fi passwords, and location data to Keychain and iCloud token extraction, clipboard reading and hijacking, foreground app monitoring, shell command execution, persistence installation, SOCKS5 proxy setup, DNS-based exfiltration, and eventual self-destruction.