{
 "tag": "trust-wallet",
 "name": "Trust Wallet",
 "group": "Wallets & apps",
 "incidents": [
  {
   "slug": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "title": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026",
   "json": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "bitcoin",
    "tron"
   ],
   "method": "fake-app",
   "product": "iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps",
   "tags": [
    "multi-evm",
    "bitcoin",
    "tron",
    "fake-app",
    "ios",
    "app-store",
    "kaspersky",
    "sparkkitty",
    "metamask",
    "ledger",
    "trust-wallet",
    "coinbase",
    "seed-phrase",
    "developer-profile"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-04-20",
   "closedAt": "2026-04-20",
   "updatedAt": "2026-04-20T12:00:00Z",
   "summary": "Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published."
  },
  {
   "slug": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "title": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "json": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Linux users installing wallet apps from the Snap Store",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "linux",
    "snap-store",
    "snapcraft",
    "exodus",
    "ledger",
    "trust-wallet",
    "slowmist",
    "seed-phrase",
    "expired-domain",
    "account-takeover"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-01-21",
   "closedAt": "2026-01-21",
   "updatedAt": "2026-01-21T12:00:00Z",
   "summary": "SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published."
  },
  {
   "slug": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "title": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "json": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana",
    "bitcoin",
    "ethereum"
   ],
   "method": "malicious-extension",
   "product": "Trust Wallet Chrome extension v2.68",
   "tags": [
    "solana",
    "bitcoin",
    "ethereum",
    "malicious-extension",
    "trust-wallet",
    "browser-extension",
    "chrome-web-store",
    "seed-phrase",
    "leaked-api-key",
    "wallet",
    "supply-chain",
    "shai-hulud",
    "npm",
    "seed-phrase-theft"
   ],
   "amountUsd": 8500000,
   "victims": 2520,
   "startedAt": "2025-12-24",
   "closedAt": "2025-12-25",
   "updatedAt": "2025-12-31T12:00:00Z",
   "summary": "A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected."
  }
 ],
 "changes": [
  {
   "incident": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "incidentTitle": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-20",
   "title": "Kaspersky discloses 26 FakeWallet apps on the App Store, active since at least fall 2025, and reports them to Apple.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026"
  },
  {
   "incident": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "incidentTitle": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-21",
   "title": "SlowMist's CISO warns that Snap Store publisher accounts tied to expired domains are being taken over to ship fake wallet apps.",
   "sourceUrl": "https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-31",
   "title": "SecurityWeek reported Trust Wallet's post-mortem: the Shai-Hulud 2.0 worm leaked developer GitHub secrets; $8.5M was drained from 2,520 addresses; users who logged in between 24 and 26 December were affected; all affected users will be reimbursed.",
   "sourceUrl": "https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-27",
   "title": "Trust Wallet launched a compensation claims process for about $7M in losses and warned of fake compensation forms.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-26",
   "title": "CyberInsider reported that the exfiltration domain metrics-trustwallet[.]com had been registered days before the breach and was taken offline.",
   "sourceUrl": "https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-25",
   "title": "ZachXBT warned that over $6M had been stolen from hundreds of users; Trust Wallet confirmed the v2.68 incident and released the fixed v2.69.",
   "sourceUrl": "https://www.theblock.co/post/383735/trust-wallet-extension-incident",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-24",
   "title": "Malicious Trust Wallet extension v2.68 was published to the Chrome Web Store at 12:32 UTC using a leaked store API key, bypassing the normal release process.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  }
 ]
}