{"investigation":{"slug":"trust-wallet","entity_name":"Trust Wallet","trust_score":55,"severity_base":null,"score_modifier":23,"confidence":1,"status":"published","content_type":"investigation","summary":"Trust Wallet is a widely-used non-custodial mobile and browser cryptocurrency wallet, originally acquired by Binance in 2018 and later divested as an independent entity. It has been the subject of multiple documented security incidents spanning 2022–2025, including a critical WebAssembly entropy vulnerability (CVE-2024-23660), a supply-chain compromise of its Chrome extension in December 2025 that resulted in approximately $8.5 million in user losses, and a historical low-entropy key generation flaw exploited in 2023. Blockchain investigator ZachXBT flagged the December 2025 browser extension incident and documented hundreds of victims.","sections":[{"content":"On December 24, 2025, a malicious version of the Trust Wallet browser extension (v2.68) was published to the Google Chrome Web Store. According to Trust Wallet's own post-incident disclosure, an attacker used a leaked Chrome Web Store API key — obtained through a supply-chain compromise (the 'Sha1-Hulud' incident in November 2025) that exposed Trust Wallet's GitHub secrets — to submit the tampered extension and bypass internal release review processes. The malicious code, injected via the posthog-js analytics library, iterated through all wallets stored in the extension and exfiltrated mnemonic phrases to an attacker-controlled domain that had been registered as early as December 8, 2025. Trust Wallet CEO Eowyn Chen acknowledged the attacker domain was registered prior to the attack and that nation-state involvement could not be ruled out. Blockchain investigator ZachXBT flagged the incident on December 25, 2025, reporting that multiple users had suffered unauthorized fund outflows and soliciting affected wallet addresses for investigation. ZachXBT determined the incident claimed hundreds of victims. On-chain analytics firm PeckShield determined that approximately $2.8 million remained in attacker wallets while over $4 million was laundered through centralized exchanges: roughly $3.3 million to ChangeNOW, $340,000 to FixedFloat, and $447,000 to KuCoin. Trust Wallet identified 2,520 verified affected wallet addresses and reported total losses of approximately $8.5 million. Over 5,000 reimbursement claims were submitted, with the company noting many were duplicates or potentially fraudulent. Trust Wallet rolled back to version 2.67 (released as v2.69), revoked all publishing API credentials, and announced a voluntary reimbursement program for verified victims.","heading":"December 2025 Chrome Extension Supply Chain Attack","sources":[],"severity":"medium"},{"content":"In November 2022, a security researcher disclosed through Trust Wallet's bug bounty program a critical vulnerability in the WebAssembly implementation of Trust Wallet's open-source Wallet Core library. The flaw caused the browser extension to use a weak pseudorandom number generator — specifically the Mersenne Twister (MT19937) — to generate private keys, rather than a cryptographically secure source of entropy. This dramatically reduced the effective key space, making it feasible for attackers to brute-force private keys for wallets created during the affected window. Wallets generated by the Trust Wallet browser extension between November 14 and November 23, 2022, were affected. Ledger's security team independently characterized the severity, stating that funds of every wallet created through the browser extension during that window could have been stolen without any user interaction. By April 2023, Trust Wallet confirmed that approximately $170,000 in user funds had been stolen via this vulnerability. The company issued a fix, publicly disclosed the incident, and announced a reimbursement plan for affected users including gas fee assistance for fund transfers.","heading":"WebAssembly Vulnerability and $170,000 Browser Extension Exploit (2022–2023)","sources":[],"severity":"medium"},{"content":"NIST assigned CVE-2024-23660 (CVSS 7.5 High) to a vulnerability in the Binance Trust Wallet iOS app stemming from misuse of the trezor-crypto library. In affected builds (introduced in trezor-crypto-ios v0.0.4, February 2018, and fixed in v0.0.7, July 2018), the random32() function seeded the PRNG using only the device's Unix timestamp via srand((unsigned)time(NULL)). Because the seed space was limited to second-level timestamps, two wallets created within the same second could generate identical mnemonic phrases. Researchers at SECBIT documented this as the 'Fomo3D Summer' vulnerability, noting that wallets created on the same second were cryptographically identical. On July 12, 2023, attackers systematically exploited this flaw against wallets created between June 30, 2017 and June 4, 2023. More than 2,100 victim addresses were identified on the Ethereum mainnet alone, with losses exceeding 1,360 ETH plus additional losses across Bitcoin, BNB Chain, Arbitrum, Polygon, and Optimism. Independent researcher group Milk Sad identified at least 6,572 unique mnemonic phrases at risk. The attack vector required no user interaction and no knowledge of any victim's seed phrase — only systematic timestamp enumeration. NIST added the flaw to its National Vulnerability Database in February 2024, citing the July 2023 exploitation as confirmed in-the-wild activity.","heading":"Low-Entropy iOS Key Generation Flaw (CVE-2024-23660) and 2023 Exploitation","sources":[],"severity":"medium"},{"content":"Trust Wallet's brand recognition has made it a high-value target for phishing operators. A documented phishing operation called TrustWalletPanel (backend domain: tttadmin.com) ran for approximately 14 months between January 2025 and February 2026. Researchers exposed the operation by exploiting an IDOR vulnerability in its backend, extracting approximately 1,900 victim conversations. The operation used fake support chat interfaces to extract seed phrases from users under false pretenses including fabricated 'OFAC compliance' requirements and alleged 'asset replacement' procedures. At least $239,000 in losses were traced to this panel across six identified operators. Broader impersonation activity across social media platforms involves fraudsters posing as Trust Wallet and Binance support representatives to solicit seed phrases and private keys from users seeking assistance.","heading":"Phishing Ecosystem and Impersonation Infrastructure","sources":[],"severity":"medium"},{"content":"Binance acquired Trust Wallet in July 2018. In late 2023, Binance divested its stake, and Trust Wallet now operates as an independent legal entity. During the period of Binance ownership, Trust Wallet benefited from significant distribution reach but also inherited reputational exposure tied to Binance's regulatory difficulties, including the November 2023 DOJ settlement in which Binance pleaded guilty to anti-money laundering and sanctions violations. Trust Wallet's non-custodial structure means it does not hold user funds or report to tax authorities such as the IRS, and it does not store IP addresses or personally identifying information. NIST's formal investigation and CVE assignment in February 2024 represent official U.S. government scrutiny of the platform's security practices.","heading":"Binance Ownership History and Regulatory Context","sources":[],"severity":"medium"}],"timeline":[{"date":"2018-02","event":"Trust Wallet iOS app introduces low-entropy key generation flaw using trezor-crypto-ios v0.0.4, seeding PRNG with Unix timestamp only","source":"","source_url":"https://secbit.io/blog/en/2024/01/19/trust-wallets-fomo3d-summer-vuln/","date_original":"2018-02-01"},{"date":"2018-07","event":"Binance acquires Trust Wallet","source":"","source_url":"https://en.wikipedia.org/wiki/Trust_Wallet","date_original":"2018-07-01"},{"date":"2018-07-16","event":"Low-entropy flaw patched in trezor-crypto-ios v0.0.7, but wallets created during the vulnerable window remain exposed","source":"","source_url":"https://secbit.io/blog/en/2024/01/19/trust-wallets-fomo3d-summer-vuln/"},{"date":"2022-11-14","event":"Trust Wallet browser extension begins generating wallets using weak Mersenne Twister PRNG; vulnerability window opens","source":"","source_url":"https://www.theblock.co/post/227730/trust-wallet-vulnerability-fix"},{"date":"2022-11-23","event":"Browser extension WebAssembly vulnerability window closes; researcher later discloses flaw via bug bounty","source":"","source_url":"https://www.ledger.com/blog/funds-of-every-wallet-created-with-the-trust-wallet-browser-extension-could-have-been-stolen"},{"date":"2023-04-22","event":"Trust Wallet publicly discloses WebAssembly PRNG vulnerability, confirms $170,000 in user losses, announces reimbursement","source":"","source_url":"https://beincrypto.com/trust-wallet-170000-loss/"},{"date":"2023-07-12","event":"Attackers exploit 2018-era low-entropy iOS flaw against 2,100+ Ethereum addresses; over 1,360 ETH stolen across multiple chains","source":"","source_url":"https://secbit.io/blog/en/2024/01/19/trust-wallets-fomo3d-summer-vuln/"},{"date":"2024-02","event":"NIST formally adds Trust Wallet iOS vulnerability to National Vulnerability Database as CVE-2024-23660 (CVSS 7.5 High)","source":"","source_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23660","date_original":"2024-02-01"},{"date":"2025","event":"TrustWalletPanel phishing operation (tttadmin.com) begins 14-month campaign targeting Trust Wallet users; at least $239,000 stolen","source":"","source_url":"https://phishdestroy.io/trustwallet-panel-exposed","date_original":"2025-01-01"},{"date":"2025-11","event":"Sha1-Hulud supply chain attack exposes Trust Wallet GitHub secrets, including Chrome Web Store API credentials","source":"","source_url":"https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update","date_original":"2025-11-01"},{"date":"2025-12-08","event":"Attacker registers exfiltration domain in preparation for Chrome extension compromise","source":"","source_url":"https://thehackernews.com/2025/12/trust-wallet-chrome-extension-bug.html"},{"date":"2025-12-21","event":"First exfiltration requests from compromised infrastructure begin","source":"","source_url":"https://thehackernews.com/2025/12/trust-wallet-chrome-extension-bug.html"},{"date":"2025-12-24","event":"Malicious Trust Wallet browser extension v2.68 published to Chrome Web Store via leaked API key; mnemonic exfiltration begins","source":"","source_url":"https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update"},{"date":"2025-12-25","event":"ZachXBT flags suspected Trust Wallet extension issue as users report drained funds; requests affected addresses from victims","source":"","source_url":"https://beincrypto.com/zachxbt-trust-wallet-security-warning-user-funds-drained/"},{"date":"2025-12-26","event":"Trust Wallet confirms v2.68 incident, rolls back to v2.67 as v2.69, revokes API credentials, announces $8.5M impact across 2,520 addresses","source":"","source_url":"https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update"}],"sources_used":[],"source_tags":["zachxbt","defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T02:54:19.755294+00:00","updated_at":"2026-08-29T01:35:26.481+00:00"}}