A half-open laptop glowing red in a dark room

Analysis · Wallets

Trust Wallet scams: fake support, approval drainers, and the December 2025 browser extension incident, per Trust Wallet's own pages

Trust Wallet's own security pages describe fake apps, fake support agents, fraudulent airdrops, copycat tokens and approval drainers as the main scams against its users. Separately, a malicious v2.68 browser extension published on 24 December 2025 drained 2,520 addresses, with about $8.5 million in assets impacted, and the reimbursement process drew over 5,000 claims, many of them, Trust Wallet says, false.

Published 2026-10-14By the CryptoGuardz Register Desk6 min read11 sources

Photo: Mithun V / Unsplash

A Trust Wallet scam almost always works by getting the user to hand over the recovery phrase or sign a transaction, not by breaking the wallet. Trust Wallet's own security pages, read on 14 October 2026, name five patterns: fake apps, fake support agents, fraudulent airdrops, copycat tokens and approval drainers. The exception was the v2.68 browser extension, which drained 2,520 addresses in December 2025.

Trust Wallet's August 2026 safety page puts the first point in one line: "Phishing sites, fake "support" agents, and crypto drainers work by convincing you to hand over the phrase or sign a bad transaction." The wallet record, custody clauses and incident file are on the Trust Wallet safety page.

Which Trust Wallet scams does Trust Wallet describe?

Scam	How it works, per Trust Wallet	Trust Wallet's stated check
Fake app	Replica apps and sites "aim to steal your secret phrase"	Developer shown as "Trust Wallet" in the app store
Fake support	Contact by email, social media or chat "claiming to be from Trust Wallet support"	Trust Wallet "will never ask for your seed phrase"
Fraudulent airdrop	Fake sites ask to connect or approve; "These transactions can instantly drain your wallet"	Unsolicited token or NFT "is usually a scam"
Copycat token	Same name, different contract address	Check the contract address
Approval drainer	A signed approval lets a contract move tokens	Revoke approvals; limit amounts

How does the fake Trust Wallet support scam work?

A message arrives first, before any real support ticket. Trust Wallet's fake-app guide, updated 19 August 2026, describes scammers who "contact you through email, social media, or chat applications, claiming to be from Trust Wallet support." Its scams guide adds where: they "pose as customer support representatives or community members on platforms like Discord and Telegram" and "direct you to malicious websites under the guise of helping you resolve an issue."

A grey fishing lure dangling on a line over dark water — Illustration only: a lure on a line. Fake support accounts work the same way: they look like help and exist to catch a recovery phrase. Photo: Maël BALLAND / Unsplash

The end point is the phrase. Trust Wallet's own line:

Remember: Trust Wallet will never ask for your seed phrase through an app or email. If you encounter such a request, it's a scam.

Trust Wallet blog, How to Avoid Fake Trust Wallet Apps, retrieved 2026-10-14

The terms, as recorded on the register, back that up: Trust Wallet does "not gain or retain your wallet password, encrypted private key, unencrypted private key, or secret phrase". So no genuine support agent has anything to restore, and anyone offering to restore it is the scam. The mechanics of the phrase are in what is a seed phrase.

How do approval drainers empty a Trust Wallet?

Through a permission the user signed. Trust Wallet's drainer guide says "Approvals can be limited to a specific amount of tokens or set as "unlimited"", and that unlimited approvals "remain active indefinitely unless revoked, even if you stop using the dApp." Disconnecting does not help: "Even after disconnecting from a dApp, token approvals remain active on the blockchain."

The guide says drainers arrive "through phishing attacks or fraudulent dApps", dressed as "investment opportunities, NFT minting sites, or token airdrops", and can use "off-chain signatures (like EIP-2612)" that need no on-chain approval transaction at all. Its countermeasures: approve only the amount needed, revoke unused approvals with tools such as Revoke.cash or Etherscan's Token Approval Checker over WalletConnect, and read the Security Scanner's warning. Trust Wallet's own description of that scanner is "a prompt to look closer, not a guarantee."

What happened with the Trust Wallet browser extension in December 2025?

A malicious build, not a scam message. Trust Wallet's incident post, published 30 December 2025 and updated 17 July 2026:

On December 24, 2025, an unauthorized and malicious version of the Trust Wallet Browser Extension (version 2.68) was published to the Chrome Web Store outside of our standard release process (without mandatory review).

Trust Wallet blog, v2.68 incident update, retrieved 2026-10-14

Trust Wallet links it, with "high confidence", to the November 2025 Sha1-Hulud npm supply chain incident, which exposed developer GitHub secrets including "the Chrome Web Store (CWS) API key". The affected window was 24 to 26 December 2025, for v2.68 users who opened the extension and logged in. Mobile app users were not affected. Trust Wallet "identified 2,520 wallet addresses that were affected by this incident and drained by the attackers, with approximately $8.5 million in assets impacted", linked to 17 attacker addresses that, Trust Wallet notes, also drained wallets not associated with the incident. The fix was a rollback: "verified clean version 2.67, released as 2.69." Trust Wallet "decided to voluntarily reimburse the affected users."

It is not the extension's first incident. CVE-2023-31290, recorded on the register, covers extension versions whose seed generation used only 32 bits of entropy, "as exploited in the wild in December 2022 and March 2023."

Who targeted the v2.68 reimbursement?

Claimants who were not victims. Trust Wallet's update says it has "received over 5,000 claims, indicating a significant number of duplicate or false submissions likely attempting to take victims’ reimbursements", against 2,520 verified addresses. Its instruction to real victims: file only through the official form at be-support.trustwallet.com, "Please be cautious of impersonators", and "Trust Wallet will never ask for your private keys, seed phrases, or passwords."

That is the pattern after any public drain: fake claim portals and fake "recovery agents". The FTC's line is that crypto payments "typically are not reversible", and paid recovery offers are covered with the official routes on the scam recovery page.

Quick answers

Is the Trust Wallet support chat a scam?

A support agent who contacts you first, or asks for your recovery phrase, is a scam by Trust Wallet's own definition: it "will never ask for your seed phrase through an app or email." Trust Wallet safety page.

Was Trust Wallet hacked?

The v2.68 browser extension was. A malicious build published on 24 December 2025 drained 2,520 addresses, with about $8.5 million in assets impacted across 17 attacker addresses; mobile users were not affected, and Trust Wallet says it is reimbursing victims.

How do I stop a wallet drainer?

Revoke unused token approvals, approve limited amounts, and never sign on a site reached from an unsolicited link. Trust Wallet's guide notes approvals stay active "even if you stop using the dApp." Self-custody checklist.

Can Trust Wallet reverse a scam transaction?

No. It holds no keys, and the FTC notes crypto payments "typically are not reversible." See the scam recovery page.

More analysis

2026-10-14How to send bitcoin to another wallet, and how to find a bitcoin wallet address, step by stepSending bitcoin means pasting the recipient's address, choosing the amount and fee, and signing. Coinbase's web flow has 6 steps and Trezor Suite's has 4. Addresses start with 1, 3, bc1q or bc1p. Mempool.space recommended 1 sat/vB on 14 October 2026, and bitcoin.org says a transaction "cannot be reversed".2026-09-28Self-custody wallet safety: a checklist before you send anythingSeven checks drawn from MetaMask's and Phantom's own help centres, read on 28 September 2026. Both say their support will never ask for a recovery phrase, neither can undo a confirmed transfer, and Phantom supports neither Tron nor BNB Chain, two common USDT networks.2026-10-09What is a seed phrase? The BIP-39 standard, and how 30 wallets handle recoveryA seed phrase is a list of 12 to 24 words, defined by the BIP-39 standard, from which a wallet derives every key it holds. Anyone with the words controls the funds. Of 30 wallets on the register, 11 offer a cloud backup and 3 split recovery with the provider.2026-10-14Pig butchering scam: how it works, what the FBI and FinCEN report, and the recovery trapPig butchering is a crypto investment scam in which a stranger builds trust over weeks, steers the victim to a fake trading platform, shows invented gains and then takes everything. FinCEN described it in alert FIN-2023-Alert005. The FBI's 2025 report records about $7.2 billion lost to crypto investment fraud. Paid "recovery" offers that follow are a second scam.2026-10-14USDT TRC-20 wallet: which wallets hold Tether on Tron, what a transfer costs in TRX, and who can freeze itTRC-20 USDT is Tether's token on the Tron blockchain, at contract TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t. Any wallet that holds Tron addresses can hold it, 16 of 30 on the register name Tron, but sending it costs TRX for energy and bandwidth, and Tether's terms let it freeze any holder's tokens.2026-10-14What is a bitcoin wallet? Keys, addresses, and who holds them in each wallet typeA bitcoin wallet is software or a device that holds private keys and signs transactions; the coins stay on the blockchain. Bitcoin.org splits wallets by where the keys live. 24 of the 30 wallets on the CryptoGuardz register name Bitcoin among their chains.

Sources

About this piece

Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.