Trust Wallet
3 incidents, 0 live. 185 days since the last new one.
3 drains in the last 12 months
3 drains in the last 12 months
2 drains in 2026
1 drains in 2025
Past
April 2026 1
-
High◐Partly contained
Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases
Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published.
iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps·Multiple EVM chains, Bitcoin, Tron·Since Apr 20, 2026·
January 2026 1
-
High✕Still active
Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps
SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published.
Linux users installing wallet apps from the Snap Store·Bitcoin, Multiple EVM chains·Since Jan 21, 2026·
December 2025 1
-
Critical✓Contained
Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets
A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected.
Trust Wallet Chrome extension v2.68·Solana, Bitcoin, Ethereum·$8.5M stolen·Since Dec 24, 2025·
No drains match these filters.