Skip to main content
AVOID.NET
Sign in

Trust Wallet

avoid.net/trust-wallet→55/100·100% conf.
[VERIFIED][src:zachxbt][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·4X1ojX…MHm7

Summary

Trust Wallet is a widely-used non-custodial mobile and browser cryptocurrency wallet, originally acquired by Binance in 2018 and later divested as an independent entity. It has been the subject of multiple documented security incidents spanning 2022–2025, including a critical WebAssembly entropy vulnerability (CVE-2024-23660), a supply-chain compromise of its Chrome extension in December 2025 that resulted in approximately $8.5 million in user losses, and a historical low-entropy key generation flaw exploited in 2023. Blockchain investigator ZachXBT flagged the December 2025 browser extension incident and documented hundreds of victims.

Connected Entities

11 entities · 60 linked investigations
Organizations
□Polygon54□Ethereum□ChangeNOW□Trust Wallet□Arbitrum□Binance□ZachXBT□Optimism
Protocols
⌂FixedFloat
Tokens
♦KuCoin♦Bitcoin
Relationships
  • Ethereum→mentioned with→Bitcoin(60%)
  • KuCoin→mentioned with→Bitcoin(70%)
  • KuCoin→mentioned with→ZachXBT(70%)
  • KuCoin→mentioned with→Ethereum(60%)
  • Optimism→mentioned with→Arbitrum(65%)
  • ZachXBT→mentioned with→Ethereum(70%)
  • Optimism→mentioned with→Ethereum(80%)
  • ZachXBT→mentioned with→Bitcoin(65%)
  • ZachXBT→mentioned with→Binance(60%)
  • ChangeNOW→mentioned with→Ethereum(65%)
  • + 23 more
Also appears in
Polygon·54StableMagnet·2Shibarium·28JUDAO·18Shibarium Bridge·32Andean Medjedovic·2Ionic Money·14Allo Protocol·57AnubisDAO·2SushiSwap RouteProcessor Exploit·54+ 50 more

Connected Through

10 shared actors · 538 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Trust Wallet?

Timeline(15 events)

February 2018

Trust Wallet iOS app introduces low-entropy key generation flaw using trezor-crypto-ios v0.0.4, seeding PRNG with Unix timestamp only

July 2018

Binance acquires Trust Wallet

16 July 2018

Low-entropy flaw patched in trezor-crypto-ios v0.0.7, but wallets created during the vulnerable window remain exposed

14 November 2022

Trust Wallet browser extension begins generating wallets using weak Mersenne Twister PRNG; vulnerability window opens

23 November 2022

Browser extension WebAssembly vulnerability window closes; researcher later discloses flaw via bug bounty

22 April 2023

Trust Wallet publicly discloses WebAssembly PRNG vulnerability, confirms $170,000 in user losses, announces reimbursement

12 July 2023

Attackers exploit 2018-era low-entropy iOS flaw against 2,100+ Ethereum addresses; over 1,360 ETH stolen across multiple chains

February 2024

NIST formally adds Trust Wallet iOS vulnerability to National Vulnerability Database as CVE-2024-23660 (CVSS 7.5 High)

2025

TrustWalletPanel phishing operation (tttadmin.com) begins 14-month campaign targeting Trust Wallet users; at least $239,000 stolen

November 2025

Sha1-Hulud supply chain attack exposes Trust Wallet GitHub secrets, including Chrome Web Store API credentials

8 December 2025

Attacker registers exfiltration domain in preparation for Chrome extension compromise

21 December 2025

First exfiltration requests from compromised infrastructure begin

24 December 2025

Malicious Trust Wallet browser extension v2.68 published to Chrome Web Store via leaked API key; mnemonic exfiltration begins

25 December 2025

ZachXBT flags suspected Trust Wallet extension issue as users report drained funds; requests affected addresses from victims

26 December 2025

Trust Wallet confirms v2.68 incident, rolls back to v2.67 as v2.69, revokes API credentials, announces $8.5M impact across 2,520 addresses

Provenance & Audit Trail
Anchored on SolanaVerify on-chainsrc:zachxbtsrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events).

full audit log →version history →

model: claude-sonnet

generated: 5/4/2026, 2:54:19 AM

last updated: 8/29/2026, 1:35:26 AM

78 views

avoid.net — verified advice for a post-truth world