Skip to main content
AVOID.NET

Trust Wallet

avoid.net/trust-wallet→55/100·100% conf.
[✓ FACT-CHECKED]· reviewed once · last review 14 Jun 2026[src:zachxbt][src:defillama]

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·4X1ojX…MHm7
last updated 2026-08-29

Summary

Trust Wallet is a widely-used non-custodial mobile and browser cryptocurrency wallet, originally acquired by Binance in 2018 and later divested as an independent entity. It has been the subject of multiple documented security incidents spanning 2022–2025, including a critical WebAssembly entropy vulnerability (CVE-2024-23660), a supply-chain compromise of its Chrome extension in December 2025 that resulted in approximately $8.5 million in user losses, and a historical low-entropy key generation flaw exploited in 2023. Blockchain investigator ZachXBT flagged the December 2025 browser extension incident and documented hundreds of victims.

Connected Entities

11 entities · 60 linked investigations
Organizations
□Polygon54□Ethereum□ChangeNOW□Trust Wallet□Arbitrum□Binance□ZachXBT□Optimism
Protocols
⌂FixedFloat
Tokens
♦KuCoin♦Bitcoin
Relationships
  • Ethereum→mentioned with→Bitcoin(60%)
  • KuCoin→mentioned with→Bitcoin(70%)
  • KuCoin→mentioned with→ZachXBT(70%)
  • KuCoin→mentioned with→Ethereum(60%)
  • Optimism→mentioned with→Arbitrum(65%)
  • ZachXBT→mentioned with→Ethereum(70%)
  • Optimism→mentioned with→Ethereum(80%)
  • ZachXBT→mentioned with→Bitcoin(65%)
  • ZachXBT→mentioned with→Binance(60%)
  • ChangeNOW→mentioned with→Ethereum(65%)
  • + 23 more
Also appears in
Hedgey·58June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)·8USD Coin (USDC)·71GeniusAI·60BNB Chain Bridge·51Polygon·54BtcTurk·52PancakeBunny·56StableMagnet·2JUDAO·18
Have evidence about Trust Wallet?

Timeline(15 events)

February 2018

Trust Wallet iOS app introduces low-entropy key generation flaw using trezor-crypto-ios v0.0.4, seeding PRNG with Unix timestamp only

July 2018

Binance acquires Trust Wallet

16 July 2018

Low-entropy flaw patched in trezor-crypto-ios v0.0.7, but wallets created during the vulnerable window remain exposed

14 November 2022

Trust Wallet browser extension begins generating wallets using weak Mersenne Twister PRNG; vulnerability window opens

23 November 2022

Browser extension WebAssembly vulnerability window closes; researcher later discloses flaw via bug bounty

22 April 2023

Trust Wallet publicly discloses WebAssembly PRNG vulnerability, confirms $170,000 in user losses, announces reimbursement

12 July 2023

Attackers exploit 2018-era low-entropy iOS flaw against 2,100+ Ethereum addresses; over 1,360 ETH stolen across multiple chains

February 2024

NIST formally adds Trust Wallet iOS vulnerability to National Vulnerability Database as CVE-2024-23660 (CVSS 7.5 High)

2025

TrustWalletPanel phishing operation (tttadmin.com) begins 14-month campaign targeting Trust Wallet users; at least $239,000 stolen

November 2025

Sha1-Hulud supply chain attack exposes Trust Wallet GitHub secrets, including Chrome Web Store API credentials

8 December 2025

Attacker registers exfiltration domain in preparation for Chrome extension compromise

21 December 2025

First exfiltration requests from compromised infrastructure begin

24 December 2025

Malicious Trust Wallet browser extension v2.68 published to Chrome Web Store via leaked API key; mnemonic exfiltration begins

25 December 2025

ZachXBT flags suspected Trust Wallet extension issue as users report drained funds; requests affected addresses from victims

26 December 2025

Trust Wallet confirms v2.68 incident, rolls back to v2.67 as v2.69, revokes API credentials, announces $8.5M impact across 2,520 addresses

Provenance & Audit Trail
Recorded on Solana ✓Verify on-chainsrc:zachxbtsrc:defillama

Decision Log

  • #3review approve+23Recorded on Solana ✓6/14/2026, 11:15:56 PM
    slot 426514439 · hash 2MsWpDZZNjK6KHVWbjSF663H12ZF3Q9ZZCjxvrBpvowm
  • #2reviewRecorded on Solana ✓6/14/2026, 11:15:56 PM
    slot 426514436 · hash 2eK2drxTgarTZ5JKdztYXnbESAwDss8Hy1pXBGrXuanu
  • #1publishRecorded on Solana ✓5/19/2026, 2:32:55 AM
    slot 420680175 · hash 91Y1D8dvMX6Wq93K3eyRTP2QopR1b8bvBgeeK9c5tJWc

This investigation is cryptographically anchored to the Solana blockchain (3 decisions).

full audit log →version history →

model: claude-sonnet

generated: 5/4/2026, 2:54:19 AM

last updated: 8/29/2026, 1:35:28 AM

78 views

avoid.net — verified advice for a post-truth world