Trust Wallet users are being drained, with $5.1M stolen so far!

[Murat]

Trust Wallet users are being drained, with $5.1M stolen so far.

An exploit targeting devices running iOS 18.5 allows an unknown attacker to secretly extract victims seed phrases from their phones.

Trust Wallet support has asked users to update iOS as soon as possible.

https://x.com/TrustWallet/status/2118592671539192132

[mikel_012]

I can only question

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

It is important to notice that this is an issue with an exploit in old iOS versions and not trust wallet. With this exploit you can steal the data from many apps in the phone

[Murat]

I can only question

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

Fair question, I think some folks used old iphones as a hardware wallet to store their crypto.

With this new hardware wallet hacks/leaks people who were considering using old iphones to store crypto should rethink again.

[mikel_012]

I can only question

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

Fair question, I think some folks used old iphones as a hardware wallet to store their crypto.

With this new hardware wallet hacks/leaks people who were considering using old iphones to store crypto should rethink again.

I do not dislike the idea of using an old iphone, but only if the phone is always disconnected and you do not use it for anything but to use your crypto wallet

To suffer this exploit the user clicked on a malicious website and this was the mistake. The old phone needs to be only for Trust Wallet. You do not access youtube or social media with your Ledger Nano X, the same rule must apply to phones used for crypto holdings

- Coruna (iOS 13.0–17.2.1): Uses malicious websites to take advantage of iOS vulnerabilities and access sensitive information, including wallet data.
- DarkSword (iOS 18.4–18.7): Uses malicious websites to get around built-in iOS security protections and access sensitive information.

[Zwei]

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

i'm guessing some of the victims were using older iphones that lost support and could no longer be updated.
or maybe some were using bypassed iphones that you can't be updated or they will get locked again, but who knows, people do dumb shit.

It is important to notice that this is an issue with an exploit in old iOS versions and not trust wallet. With this exploit you can steal the data from many apps in the phone

i read that trust wallet were keeping seed phrases in raw plaintext RAM, if that's true, then they are also to blame.

To suffer this exploit the user clicked on a malicious website and this was the mistake. The old phone needs to be only for Trust Wallet. You do not access youtube or social media with your Ledger Nano X, the same rule must apply to phones used for crypto holdings

- Coruna (iOS 13.0–17.2.1): Uses malicious websites to take advantage of iOS vulnerabilities and access sensitive information, including wallet data.
- DarkSword (iOS 18.4–18.7): Uses malicious websites to get around built-in iOS security protections and access sensitive information.

this reminds me of some fake TRON energy rental websites that were targeting iOS users on the forum: https://bitcointalk.org/index.php?topic=5593149.0

[Yamane_Keto]

I can only question

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

they might use an older device as wallet and that old iPhones are more secure, by connecting it to the internet only to send a transaction before disconnecting again. They assume this is safe because the device is used exclusively for transactions and not updating or downloading any new apps.

ZachXBT recommended this. stating that iPhones are secure for use as cryptocurrency wallets.

https://cryptoslate.com/is-using-an-old-iphone-is-safer-than-a-crypto-hardware-wallet-zachxbt-thinks-so/

ZachXBT recently argued that a dedicated iPhone offers better security than a hardware wallet, a line of reasoning that already splits crypto's security community

[logfiles]

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

You have to understand that not everyone quickly updates the device's OS as soon as it's released and there could probably be people using much older devices that are no longer supported for the new update

It is important to notice that this is an issue with an exploit in old iOS versions and not trust wallet. With this exploit you can steal the data from many apps in the phone

it so happens that trust wallet is at the center of it. We could be seeing victims who are using other wallets that are supported by iOS too but we are not.

[Synchronice]

I can only question

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

Fair question, I think some folks used old iphones as a hardware wallet to store their crypto.

With this new hardware wallet hacks/leaks people who were considering using old iphones to store crypto should rethink again.

Old phones can be used as crypto storage if they are offline. If they are going online, then the firmware should be updated to the latest version or there is another option, keep phone in factory reset conditions and do not download anything when you connect online, do not visit any website, only use the internet for signing a transaction. I think that an average person will be safe with this approach but if someone actively uses old, unsupported smartphone with their crypto wallet installed on it, they are risking too much and playing with the fire.

[mikel_012]

It is important to notice that this is an issue with an exploit in old iOS versions and not trust wallet. With this exploit you can steal the data from many apps in the phone

it so happens that trust wallet is at the center of it. We could be seeing victims who are using other wallets that are supported by iOS too but we are not.

Yes. I think trust wallet is just the biggest wallet because they are owned by binance

If it was entirely the fault of trust wallet this would happen to every trust wallet user in every ios version

This is an exploit in iOS where they can read the app files of your phone just with a visit to a malicious website, it can happen to other wallets very easily

[FinneysTrueVision]

I can only question

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

It is important to notice that this is an issue with an exploit in old iOS versions and not trust wallet. With this exploit you can steal the data from many apps in the phone

Late 2024 and early 2025, when this update was released, was when they started adding different AI features into the operating system that take up a lot of storage. The base storage is always very low on Apple devices compared to Android and Windows manufacturers. This makes it impossible to install updates sometimes until you have deleted enough apps and files.

[r_victory]

Keeping the system updated is what prevents this type of problem. It's even questionable why someone would use an outdated system and still have a cryptocurrency wallet installed on that same system. The thing is, not everyone can afford a new, more up-to-date phone, and this ends up making them more vulnerable to attacks. I've had to change phones because I no longer received updates, which I think is absurd. Sometimes the time window isn't even that long, but since I have banking apps and wallets, I have to find a way to buy them.

[PrivacyG]

ZachXBT recommended this. stating that iPhones are secure for use as cryptocurrency wallets.

https://cryptoslate.com/is-using-an-old-iphone-is-safer-than-a-crypto-hardware-wallet-zachxbt-thinks-so/

ZachXBT recently argued that a dedicated iPhone offers better security than a hardware wallet, a line of reasoning that already splits crypto's security community

It really depends whether the said Hardware Wallet has any connection to the external World at all.  If yes, then an iPhone is just as good.  In other words, USELESS.

Hardware Wallets are supposed to be the safest method of storing your Bitcoin, and the safety and security is DRASTICALLY less when there are ways of connecting your Hardware Wallet to the external World.  Bluetooth, Wi-Fi, NFC, what ever it is, these all have vulnerabilities and are attack vectors.

iPhones are not the best security for your Bitcoin.  ZachXBT simply had a bad advice day and no one should follow it.

[RGBTC]

ZachXBT recommended this. stating that iPhones are secure for use as cryptocurrency wallets.

ZachXBT is not a cryptographic security expert, I think he thinks based on his past investigative activities (only limited to chain analysis) and also his own experience.

As far as I remember, it's not only recently that iOS has also had security reports, but also several times in the last few years they have revealed OS version vulnerabilities and (fortunately) always early encouraged users to update/install patches. However now the situation is different, attackers may have faster tools/capabilities than OS security researchers themselves to execute attacks.

[shinratensei_]

I can only question

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

Fair question, I think some folks used old iphones as a hardware wallet to store their crypto.

With this new hardware wallet hacks/leaks people who were considering using old iphones to store crypto should rethink again.

You shouldn't confuse base version with updated version, 18.5 is released in may 2025 with all security patches, people who don't like liquid glass decided to stay with IOS 18 and darksword affect up to 18.7, security updates still being pushed for and Apple started fixing the exploit on 18.7.3, 18.7.7 finally patched the thing and fully closes the exploit. Even some IOS 26 got affected because it shared legacy code. So when the article talk about IOS 18 it's not the unupdated base version of IOS 18 only, it's talking about any IOS 18 version that still have the exploit.

[mikel_012]

You shouldn't confuse base version with updated version, 18.5 is released in may 2025 with all security patches, people who don't like liquid glass decided to stay with IOS 18 and darksword affect up to 18.7, security updates still being pushed for and Apple started fixing the exploit on 18.7.3, 18.7.7 finally patched the thing and fully closes the exploit. Even some IOS 26 got affected because it shared legacy code. So when the article talk about IOS 18 it's not the unupdated base version of IOS 18 only, it's talking about any IOS 18 version that still have the exploit.

Yes, exactly

Old versions from old phones also received the security update that fixes the exploit and vulnerability

You did not need a new phone to be safe all you had to do is install the update that was available

But many people only update their phones and software when they lose money. Even today you can find many websites full of vulnerabilities from old versions of code

[Darker45]

The $5.1 million stolen are all coming from Trust Wallet users only or from all iOS users whose different crypto wallets were compromised?

For the past several days, I've read warnings and complaints against Trust Wallet. It seems it's mostly Trust Wallet users whose funds are stolen, to the point that I thought there was a malicious operation to try bring down the brand.

However, aside from the confirmation of attacks on old iOS versions, there seems to be no official confirmation by Trust Wallet itself as to how big the total amount that suddenly left their users' wallet unauthorized.

[hugeblack]

These attacks do not target Trust Wallet alone; rather, they scan the device for any cryptocurrency applications or wallets. They require initial access which is typically gained when a user visits compromised or spoofed websites. Keeping iOS updated and enabling "Lockdown Mode" is sufficient to mitigate these risks; however, avoiding the use of "hot wallets" altogether is the best solution.

[nc50lc]

i read that trust wallet were keeping seed phrases in raw plaintext RAM, if that's true, then they are also to blame.

I'd like to read it, do you remember where you read this?
A link to the article/news would be great.

Because depending on the context, it might just be a normal operation of decrypting the secrets (thus, will be saved in RAM for a few milliseconds) to be able to sign transactions, etc.
Or if it's something stupid, like keeping it plaintext in memory during the whole operation, then it doesn't need a compromised OS to be vulnerable.

[ultrloa]

Trust Wallet users are being drained, with $5.1M stolen so far.

An exploit targeting devices running iOS 18.5 allows an unknown attacker to secretly extract victims seed phrases from their phones.

Trust Wallet support has asked users to update iOS as soon as possible.

https://x.com/TrustWallet/status/2118592671539192132

Oh men, Trust wallet again? That wallet is a total crap. People must leave it or better uninstall it. Because it seems there's no improvement happened in their platform, this is why they always get affected by many hacking incidents.

They didn't refund my stolen funds, when version 2.68 exploit happened and I swear to god not to use that wallet anymore.

People should learn from many negligence done by that platform, then just use other more secure hardware wallets.

[ABCbits]

These kits exploit flaws in iOS itself. They don’t rely on a flaw in any wallet app, but once a device is compromised they can access wallet data stored on it.

CMIIW, but even if the iOS is exploited, shouldn't the wallet data remain secure, assuming it's encrypted with user PIN or password?

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

It is important to notice that this is an issue with an exploit in old iOS versions and not trust wallet. With this exploit you can steal the data from many apps in the phone

It's probably combination of
1. Not enabling auto-update (AFAIK it wasn't enabled by default in older days).
2. People don't even think about updating their phone OS when application they use appear to work normally. I've seen few people only update their OS or buying new phone when they can't use their banking or messaging apps due to very old OS.