Is Trust Wallet safe to connect?
Self-custody wallet · Bitcoin, Ethereum, BNB Chain, Solana, Tron, 100+ chains. Checked 2026-10-25; every line links its source.
Worst case: Trust Wallet is self-custody, so a leaked recovery phrase or a malicious extension build (as happened with v2.68 in Dec 2025) can empty every wallet on that device. A reimbursement like Trust Wallet's was voluntary and not guaranteed.
Safe setup in 3 steps
- Install only from trustwallet.com/download: Chrome Web Store ID egjidjbpglichdcondbcbdnbeeppgdph, App Store id1288339409, Google Play com.wallet.crypto.trustapp. Keep the extension updated, and don't keep large balances in any browser extension.
- Trust Wallet never DMs first and never asks for your phrase. Ignore 'compensation' or 'support' links on social media, and use only support.trustwallet.com.
- Use a separate wallet with a small balance for bots and dapps, keep savings on a phone app or hardware wallet, and revoke old approvals with Revoke.cash.
What it can do with your money
| Who holds the keys | You hold the keys Self-custody: 'You control your private keys, stored safely on your device and encrypted using AES.' The app also offers staking, stablecoin 'daily rewards' and prediction markets, which run through outside protocols and partners. source |
|---|---|
| Can funds be sent out to any address? | Yes. You sign every send yourself, to any address. source |
| Swaps and third parties | Swaps run through third parties: THORChain for native cross-chain swaps and 1inch. 'Trust Wallet charges no service fees for executing these swaps'. Provider and network fees still apply. source |
Official links
- Website:
trustwallet.com - Website:
support.trustwallet.com - Telegram:
@trust_announcements - Telegram:
@trustwallet - X:
@TrustWallet - GitHub:
github.com/trustwallet - App:
https://chromewebstore.google.com/detail/trust-wallet/egjidjbpglichdcondbcbdnbeeppgdph - App:
https://apps.apple.com/app/apple-store/id1288339409 - App:
https://play.google.com/store/apps/details?id=com.wallet.crypto.trustapp
Where we confirmed these
Known fakes
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2025-12-26 | Fake compensation forms and impersonators targeted v2.68 victims. Trust Wallet told users to claim only through its official support portal (be-support.trustwallet.com per its incident post). | warning issued | source | |
| 2025-12-24 | Browser extension v2.68 compromised: an attacker used a Chrome Web Store API key exposed in the Nov 2025 Sha1-Hulud supply-chain attack to publish a malicious build. It drained wallets that logged in between 2025-12-24 and 2025-12-26 11:00 UTC. About $8.5M was tied to 17 attacker addresses, and 2,520 wallet addresses were drained. Malicious code was served from metrics-trustwallet.com. | ~$8.5M (2,520 addresses; earlier reports said $7M) | Trust Wallet pledged voluntary reimbursement after case-by-case verification. Coincu (via MEXC) reported a first payout round in Jan 2026; we found no total paid. Fixed by rolling back to clean v2.67, released as v2.69. | source |
| 2025-07-03 | Koi Security found 40+ fake wallet add-ons on the Firefox store impersonating Trust Wallet, MetaMask, Phantom, Coinbase, Exodus and others (third-party report). | reported to Mozilla | source |