Small brass and silver keys scattered over dark wooden boards

Analysis · Wallets

MetaMask vs Trust Wallet: what their terms say on custody, chains, swap fees and incidents

Published 2026-10-14By the CryptoGuardz Register Desk6 min read15 sources

Photo: Akhilesh Sharma / Unsplash

In short, from the documents

MetaMask vs Trust Wallet: custody, fees, incidents

Both are self-custody wallets whose terms say the company cannot recover a lost phrase. MetaMask publishes a 0.875% swap fee and names 19 networks; Trust Wallet says 100+ blockchains, publishes no standard swap fee, and reimbursed users after a December 2025 extension breach.

Piece published 2026-10-14Reviewed by CryptoGuardz Register Desk, editorial desk

MetaMask and Trust Wallet are both self-custody wallets: neither company holds the keys, and both say a lost recovery phrase cannot be restored. The differences are in the paperwork. MetaMask publishes a 0.875% swap fee and names 19 networks; Trust Wallet claims "100+ blockchains", publishes no standard swap fee rate, and is the one of the two with recorded incidents, including a December 2025 extension breach that hit 2,520 addresses.

Both wallets' documents were read on 14 October 2026, alongside the records on the wallet register. Nothing here is financial advice.

MetaMask vs Trust Wallet at a glance

Point	MetaMask	Trust Wallet
Company in the terms	Consensys Software Inc.	"Trust Wallet, and/or its affiliates", unnamed
Terms last updated	June 2026	1 January 2024
Governing law	Texas (US users), England and Wales (UK), Ireland (others, unless they elect)	Hong Kong
Networks named	19 on the help centre	"100+ blockchains" on the homepage
Tron	Listed	Listed
Swap fee in its documents	0.875%	No standard rate; 0% on some stablecoin pairs
Cloud backup of the phrase	None; terms warn against it	Encrypted copy, user password
Incidents on the register	None recorded	Two, 2023 and 2025
Public code	Extension repository	Wallet Core library, Apache-2.0

Entries: MetaMask and Trust Wallet, with the register's own pairing on MetaMask vs Trust Wallet.

Who holds the keys in MetaMask and Trust Wallet?

The user, in both. MetaMask's terms say it "WILL NOT STORE A BACKUP OF, NOR WILL BE ABLE TO DISCOVER OR RECOVER, YOUR PRIVATE KEY OR SECRET RECOVERY PHRASE", and warn that storing the phrase "ON A CLOUD STORAGE SYSTEM" may increase the risk of theft. Trust Wallet's terms read:

Please note that we do not gain or retain your wallet password, encrypted private key, unencrypted private key, or secret phrase connected to your wallet.

Trust Wallet terms of service, as recorded on the wallet register 2026-09-22

A single antique key with an ornate bow against a pale wall — Illustration: one key. In both wallets the user alone holds the recovery phrase, and neither company can restore it. Photo: Everyday basics / Unsplash

The two part company on backups. Trust Wallet offers an encrypted copy of the phrase in the user's cloud account, protected by a password the user sets, which the register records as leaving custody unchanged. MetaMask offers none and, in its own terms, discourages the practice. Which risk a user prefers, a copied cloud file or a lost sheet of paper, is the actual choice. What is a seed phrase covers both.

One more custody-adjacent fact. Under default settings MetaMask routes requests through Infura, which is operated by Consensys itself, per the privacy notice on the register. Trust Wallet's terms describe node servers as selected by the user.

Which chains do they support?

MetaMask's help centre, read on 14 October 2026, lists Ethereum, Bitcoin, Linea, Base, Solana, Tron, Polygon, BNB Chain, Arbitrum, Monad, Robinhood Chain, OP, Sei, Avalanche, zkSync Era, MegaETH, HyperEVM, Arc and Tempo: 19 names. Trust Wallet's homepage says users can "Send, receive and manage assets on Bitcoin, Ethereum, Solana, BNB Smart Chain and 100+ networks from one wallet", and its site links a TRON wallet page. The register confirmed TON for Trust Wallet and not for MetaMask.

Both name Tron, which matters for USDT on TRC-20; see USDT TRC-20 wallets.

What are MetaMask's and Trust Wallet's swap fees?

MetaMask states one: its swaps guide lists "MetaMask fee: 0.875%" alongside the quote rate and the network fee. Gasless swaps, where gas is folded into the quote, are limited to Ethereum Mainnet, BNB Smart Chain, Linea and Arbitrum, and to Base in the extension only.

Trust Wallet does not state a standard rate in any document read. Its terms say "Trust Wallet reserves the right to introduce charges in the future at its discretion" and that it "may receive a revenue share" from third-party fees. A blog post of 27 August 2026 says "the Trust Wallet swap fee is 0%" when swapping one eligible stablecoin for another on the same chain, and that otherwise "the standard applicable fee will apply", without saying what that is. Trust Wallet's standard swap fee: not verified. In both wallets, network gas is separate: "Gas is paid to the blockchain network, not to Trust Wallet."

Has MetaMask or Trust Wallet been hacked?

The register records no MetaMask incident. It records two for Trust Wallet.

The recent one was a supply-chain attack on the browser extension. Trust Wallet's own account, recorded on the register:

On December 24, 2025, an unauthorized and malicious version of the Trust Wallet Browser Extension (version 2.68) was published to the Chrome Web Store outside of our standard release process

Trust Wallet blog, as recorded on the wallet register 2026-09-22

Trust Wallet identified 2,520 affected addresses and "approximately $8.5 million in assets impacted", which it linked to 17 attacker addresses that also drained wallets unrelated to the incident, and chose to reimburse. Its support notice, dated 29 December 2025, says the incident "impacts only users of the Browser Extension version 2.68" and that claims need an ID, proof of wallet ownership and KYC verification, with refunds sent "to a newly created wallet".

The older one is CVE-2023-31290: Trust Wallet Core before 3.1.1, used in the browser extension, generated recovery phrases from 32 bits of entropy, and the CVE text says it was "exploited in the wild in December 2022 and March 2023". Full records are on Trust Wallet's safety page and MetaMask's.

Are MetaMask and Trust Wallet open source?

Partly, on what GitHub shows. The MetaMask extension has a public repository; its licence is not named on the repository page, so the licence terms are not verified. Trust Wallet publishes Wallet Core, "available under the Apache 2.0 license", which its README describes as "a core part of the popular Trust Wallet" app. The page does not say the app itself is open source: not verified.

The scam that hits both: address poisoning

Neither wallet can stop a user pasting the wrong address. MetaMask's help centre explains the trick: "The scammer sends you a transaction of negligible value from the dummy account they created", hoping "you might inadvertently copy their address from your transaction history". Its advice: "Always verify the destination address before you send, especially for high-value transactions." The step-by-step version is in how to send bitcoin to another wallet. Casino deposits run the same risk; see MetaMask and crypto casinos.

A yellow triangle warning sign with a skull and crossbones — Illustration: a poison sign. Address poisoning plants a lookalike address in a wallet's history for the user to copy. Photo: Mikael Seegen / Unsplash

Quick answers

Is MetaMask or Trust Wallet custodial?

Neither. Both terms say the company does not hold or recover the phrase. Trust Wallet offers an optional encrypted cloud copy; MetaMask does not. See the comparison page.

What fee does MetaMask charge on swaps?

0.875%, per MetaMask's swaps guide read on 14 October 2026, plus the network fee. Trust Wallet publishes no standard rate; eligible same-chain stablecoin swaps are 0%.

Was Trust Wallet hacked?

Its browser extension version 2.68, published on 24 December 2025, was malicious. Trust Wallet counted 2,520 affected addresses and about $8.5 million in assets impacted across 17 attacker addresses, and reimbursed users. See Trust Wallet on the register.

Do MetaMask and Trust Wallet support Tron?

Both name Tron: MetaMask on its network list, Trust Wallet with a TRON wallet page. That allows USDT on TRC-20, with TRX needed for fees.

More analysis

2026-10-14How to send bitcoin to another wallet, and how to find a bitcoin wallet address, step by stepSending bitcoin means pasting the recipient's address, choosing the amount and fee, and signing. Coinbase's web flow has 6 steps and Trezor Suite's has 4. Addresses start with 1, 3, bc1q or bc1p. Mempool.space recommended 1 sat/vB on 14 October 2026, and bitcoin.org says a transaction "cannot be reversed".2026-09-28Self-custody wallet safety: a checklist before you send anythingSeven checks drawn from MetaMask's and Phantom's own help centres, read on 28 September 2026. Both say their support will never ask for a recovery phrase, neither can undo a confirmed transfer, and Phantom supports neither Tron nor BNB Chain, two common USDT networks.2026-10-09What is a seed phrase? The BIP-39 standard, and how 30 wallets handle recoveryA seed phrase is a list of 12 to 24 words, defined by the BIP-39 standard, from which a wallet derives every key it holds. Anyone with the words controls the funds. Of 30 wallets on the register, 11 offer a cloud backup and 3 split recovery with the provider.2026-10-14Pig butchering scam: how it works, what the FBI and FinCEN report, and the recovery trapPig butchering is a crypto investment scam in which a stranger builds trust over weeks, steers the victim to a fake trading platform, shows invented gains and then takes everything. FinCEN described it in alert FIN-2023-Alert005. The FBI's 2025 report records about $7.2 billion lost to crypto investment fraud. Paid "recovery" offers that follow are a second scam.2026-10-14USDT TRC-20 wallet: which wallets hold Tether on Tron, what a transfer costs in TRX, and who can freeze itTRC-20 USDT is Tether's token on the Tron blockchain, at contract TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t. Any wallet that holds Tron addresses can hold it, 16 of 30 on the register name Tron, but sending it costs TRX for energy and bandwidth, and Tether's terms let it freeze any holder's tokens.2026-10-14Is bitcoin safe? The protocol, the custody risk and the scams, by the documentsBitcoin's protocol is secured by proof of work and has produced 971,395 blocks since January 2009. The money people lose goes through custody failures and scams: the FBI's IC3 recorded 181,565 crypto-related complaints and $11.366 billion in losses in 2025, about $7.2 billion of it investment fraud.

Sources

About this piece

Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.