Trust Wallet

Is Trust Wallet safe?

The mobile app has a reasonable record; the browser extension does not. Trust Wallet is a self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary wallet owned by Binance, and the phone app has never been tied to a loss from its own code. The extension, however, has failed twice in three years, and in December 2025 an attacker pushed a malicious version through Trust Wallet's own Chrome Web Store account. We score it 68/100, a C.

That incident matters more than the money involved. When a release from the official store listing is malicious, nothing a careful user does can save them. Trust Wallet promised to repay the victims and has tightened its release process, but the security score has to reflect what happened.

What happened with the Trust Wallet extension hack?

According to Trust Wallet's own update, its developers' GitHub secrets were exposed in the Sha1-Hulud npm supply-chain attack of November 2025. That gave the attacker the extension's source code and the API key used to publish to the Chrome Web Store.

Date	Event
24 Dec 2025	Malicious v2.68 uploaded with the leaked key, outside the normal release process, and approved by the store
25 Dec 2025	First drained wallets reported publicly
By 26 Dec 2025	Clean code re-released as v2.69; publishing keys revoked
27 Dec 2025	Claims process opened; Binance's founder says Trust Wallet "will cover"
Jan 2026	First round of compensation reported paid

The rogue build drained wallets of users who unlocked the extension during the window: 2,520 addresses, about $8.5 million in total moved to 17 attacker addresses. The extension had roughly a million users at the time, according to The Block. Trust Wallet said it received more than 5,000 claims, many of them duplicates or fraudulent, which slowed repayment. Its update from July 2026 still describes reviews as case by case.

The earlier extension bug

In April 2023 Trust Wallet disclosed a flaw in the WebAssembly build of Wallet Core, its key library. Wallets created in the browser extension between 14 and 23 November 2022 were generated with a flaw that attackers could exploit to recover the keys. Attackers exploited it twice for about $170,000, and Trust Wallet set up refunds. Mobile wallets and imported seeds were not affected. One weak-key bug and one hijacked release, both in the same product, is why security record scores 55.

How Trust Wallet stores your keys

Trust Wallet uses a standard 12-word seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary generated on your device. The company says private keys are AES-encrypted and kept in the device's key store, and that they never leave the phone. You can write the phrase down and restore it in almost any other multi-chain wallet, so you are never locked in. It also supports connecting a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary. That is the normal model for a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary and scores 76; our rubric caps software wallets at 84 because the keys sit on an internet-connected device.

If you used the extension in late 2025, the advice from Trust Wallet is to treat any wallet that was unlocked in v2.68 as compromised for good and move funds to a newly created wallet, not just update.

In 2026 the app also added trading products: perpetual futures ("Trust Wallet Perps"), Hyperliquid's HIP-4 outcome contracts for prediction markets (from May 2026) and tokenised US shares such as bStocks on BNB Chain. Trust Wallet calls them self-custodialSelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary, and your keys do stay on your phone, but positions rely on the protocols and token issuers behind them, and leverage brings liquidation risk. They are outside this score.

Scam protection and transparency

Trust Wallet's Security Scanner is one of its better features. It runs automatically inside the signing flow on mobile and in the extension, simulates each transaction against the current chain state to show what leaves and what arrives, and checks the destination against lists of drainersDrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary and malicious approvals. Like MetaMask's alerts, it warns but does not block.

Transparency is mixed. Wallet Core is open source under Apache 2.0 and widely reused, and Trust Wallet publishes a list of audits: Cure53 and CertiK on the extension in 2023, a Salus penetration test in 2024 and Quantstamp and Halborn reviews of its smart accounts in 2025. But the apps you actually install are closed source, so no one outside can confirm that the build matches reviewed code, which is exactly the gap the 2025 attacker used.

How to stay safe with Trust Wallet

1. Prefer the mobile app for anything beyond small amounts; both incidents hit only the extension.
2. Keep the extension updated and install it only from the link on trustwallet.com.
3. Never enter your seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary in a "reimbursement" or "support" form. Fake claim pages appeared within days of the 2025 hack.
4. Revoke approvals you no longer use and stop when the scanner shows a warning.
5. For savings, use a hardware wallet such as Ledger and keep only spending money in a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary.

The Binance exchange is a separate product with its own risks; see our Binance page. Its fines are not counted here.

How we scored it

Scam protection (82) and company record (78) are Trust Wallet's strongest factors. Security record (55) is the weakest, because a malicious release went out through its own Chrome Web Store account in 2025 after an earlier key bug in 2022. MetaMask scores higher mainly because it has no comparable incident.