CryptoGuardzIndependent crypto register
Read the binding document, check it against the issuing register, publish the disagreement18+ · Gambling carries risk of loss

Choose a language

The register is published in these languages. If this page has no version in one of them, you go to that language’s home page.

Photo: Jason Dent / UnsplashWallet register · trustwallet.com

Is Trust Wallet safe? What its terms and incident record say

No score publishedLast reviewed 2 recorded incidents
In short, from the documents

Is Trust Wallet safe?

Trust Wallet's terms place the keys with you and disclaim access to them. No party is disclosed as able to block an address. 2 primary-source incidents are recorded. Its terms prohibit illegal gambling only. Liability is capped at 100 US dollars.

Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk

Trust Wallet: keys held by you. Self-custodial, by the terms.Who holds the keysYouDeviceSharedProviderMarked: YouSelf-custodial, by the terms.Trust Wallet: who can block an address: none disclosed in the documents read.Who can block an addressNobodyProviderThird partyMarked: NobodyNone disclosed in the documents read.Trust Wallet: gambling clause: illegal gambling only, read 2026-09-28. Only illegal gambling is banned; lawful use is not barred. Whether a casino is lawful is your local law's question.Gambling clauseBannedSilentAllowedMarked: Allowed, illegal gambling onlyOnly illegal gambling is banned; lawful useis not barred. Whether a casino is lawful isyour local law's question. Read 2026-09-28.Trust Wallet: 2 primary-source incidents recorded.Incidents on record2incidentsOnly incidents a primary source records.
Trust Wallet: keys held by you; who can block an address: none disclosed in the documents read; gambling clause: illegal gambling only; 2 primary-source incidents recorded. From its own terms, documents last checked . Not a rating. Drawn by the CryptoGuardz Register Desk from the record.

This page answers the short questions. The full Trust Wallet entry quotes every clause behind them.

Disclosure: CryptoGuardz has no commercial relationship with Trust Wallet and earns nothing if you install it. Every statement below is read from a document Trust Wallet publishes or from a public record, and each carries the date it was read. Corrections go to the corrections page.

Trust Wallet review: the documents

This is a review of the documents Trust Wallet publishes, not a test of the product: no transaction was signed and no code audit was read. The binding document names no company you contract with. The custody position comes from the Trust Wallet Terms of Service, last updated 1 January 2024, read 2026-09-22. The record quotes 16 clauses across 7 topics, and 9 sub-service clauses where the app hands a swap, purchase or staking to another party. Trust Wallet's terms place the keys with you and disclaim access to them. A cloud or hosted backup is offered. 3 clauses let the provider suspend or withdraw access to the app; the keys stay yours, the interface does not. Liability is capped at 100 US dollars. Its terms prohibit illegal gambling only. 7 points could not be verified and are listed below.

Has Trust Wallet been hacked?

2 incidents are recorded, each from a primary source: a disclosure by the company, a public vulnerability register or a regulator. The descriptions are the record’s, unedited, with the date and the source.

Incident · trustwallet.com · support.trustwallet.com

A malicious build of the Trust Wallet browser extension, version 2.68, was published to the Chrome Web Store outside Trust Wallet's standard release process, using a Chrome Web Store API key that Trust Wallet says was leaked during the November 2025 Sha1-Hulud npm supply chain incident. Trust Wallet identified 2,520 affected wallet addresses and approximately 8.5 million US dollars in assets drained, and elected to reimburse affected users. The reimbursement claim process requires claimants to submit a scan of a government-issued identification document to a third-party KYC partner.

On December 24, 2025, an unauthorized and malicious version of the Trust Wallet Browser Extension (version 2.68) was published to the Chrome Web Store outside of our standard release process (without mandatory review). This version contained malicious code that, when loaded, allowed the attacker to access sensitive wallet data and execute transactions without authorization.

Retrieved 2026-09-22.

Incident · nvd.nist.gov · community.trustwallet.com

CVE-2023-31290. Trust Wallet Core before version 3.1.1, as used in the Trust Wallet browser extension versions 0.0.172 through 0.0.182, generated mnemonics from only 32 bits of entropy because the Mersenne Twister was seeded with a single 32-bit value, reducing the space to roughly four billion possible mnemonics. Exploited in the wild in December 2022 and March 2023.

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023.

The CVE text and the reference list were read from the GitHub Advisory Database mirror at https://github.com/advisories/GHSA-pm4f-pggw-8jwc. The NVD record and the Trust Wallet community postmortem are cited as the primary sources but were not themselves fetched in this pass.

Retrieved 2026-09-22.

An incident on this list is a disclosed event, not a verdict on the product today. The absence of other incidents is not proof that none happened.

Trust Wallet support and scams

The official domain in the record is trustwallet.com. The help pages this register read include Trust Wallet support, Security Notice: Browser Extension Version 2.68 Vulnerability and Binance announcement, Binance Acquires Trust Wallet, 31 July 2018. Type the domain yourself rather than following a link to it.

Real support never asks for a seed phrase. The recovery phrase restores the whole wallet on any device, so whoever is given it can move everything it controls, and no support agent needs it to answer a question. What Trust Wallet stores, by the record: An encrypted copy of the secret recovery phrase, encrypted with a password the user sets. Separately, for the SWIFT smart contract wallet, a passkey is created automatically at wallet creation and is used in place of a password or twelve-word phrase to protect and recover the wallet.

Support links reached from ads or direct messages are the commonest drain. A search ad, a reply to a public complaint or a direct message offers help, the link opens a page that looks like trustwallet.com, and the page asks you to “validate” or “sync” the wallet by entering the phrase. Once it is typed in, the wallet is emptied and nothing in the terms gives a way back. The record also describes an incident involving a malicious version or app (dated above).

If money has already gone, the next message offering to get it back is the commonest second loss. The FBI, the FTC, the CFTC and the UK FCA warnings about it are quoted on crypto scam recovery: what is real.

Trust Wallet fees and limits

One clause in the record set a fee or a limit on what you can do through the app. They are quoted as written. Network fees paid to the chain are not part of the record.

Swap sub-service · 1 of 1Retrieved 2026-09-22
The amount that you can trade through DEX each day is subject to the rules and limitations set by the third-party developers of the Smart Contracts. Trust Wallet does not control these limits and is not responsible for enforcing them.
trustwallet.com

What we could not verify

The gaps in this record, as the record states them. A point listed here was looked for and not confirmed; it is neither a finding for Trust Wallet nor against it.

  • The legal entity behind Trust Wallet. No company name, company number or registered address appears in the terms of service, the privacy notice or the About Us page. This is the most significant gap in the file: the user's counterparty is not identified in the document that binds them.
  • The default RPC or node provider and what it can see. The terms refer to node servers you have selected but name no default provider, and the privacy notice does not identify one.
  • The named swap counterparty or aggregator. The terms describe third-party DApps and DEX generically; no aggregator is named in any primary document retrieved.
  • The named staking provider or validator operator.
  • The full list of fiat on-ramp providers. MoonPay is named in a Trust Wallet product announcement; no complete list was found in a primary document.
  • The NVD record for CVE-2023-31290 and the Trust Wallet community postmortem were cited via the GitHub Advisory Database mirror rather than fetched directly.
  • Whether the terms of service, last updated 1 January 2024, have been superseded by a newer version not published at the canonical URL. The retrieved page carries that date.

Analysis on Trust Wallet and wallets

MetaMask vs Trust Wallet: what their terms say on custody, chains, swap fees and incidentsBoth are self-custody wallets whose terms say the company cannot recover a lost phrase. MetaMask publishes a 0.875% swap fee and names 19 networks; Trust Wallet says 100+ blockchains, publishes no standard swap fee, and reimbursed users after a December 2025 extension breach.Trust Wallet scams: fake support, approval drainers, and the December 2025 browser extension incident, per Trust Wallet's own pagesTrust Wallet's own security pages describe fake apps, fake support agents, fraudulent airdrops, copycat tokens and approval drainers as the main scams against its users. Separately, a malicious v2.68 browser extension published on 24 December 2025 drained 2,520 addresses, with about $8.5 million in assets impacted, and the reimbursement process drew over 5,000 claims, many of them, Trust Wallet says, false.Coinbase vs Coinbase Wallet: a custodial exchange account and a self-custody wallet, and the Base app renameCoinbase is a custodial exchange account where crypto is "stored on the platform"; Coinbase Wallet is a self-custody app where Coinbase "never has access to your recovery phrase". The wallet's App Store notes called it Base app for months, and since version 30.11 say "We're now Coinbase Wallet."How to buy Solana in the US: which exchanges list SOL, what they charge, and what moving it to a wallet costsCoinbase, Kraken, Robinhood, PayPal and Gemini each list SOL on their own pages, read on 14 October 2026; Cash App's crypto disclosures cover bitcoin and stablecoins, not SOL. Buy fees follow each platform's general crypto schedule. On-chain, Solana charges 5,000 lamports per signature, and the refundable rent-exempt minimum is being cut by up to 90% in five steps from September 2026.How to send bitcoin to another wallet, and how to find a bitcoin wallet address, step by stepSending bitcoin means pasting the recipient's address, choosing the amount and fee, and signing. Coinbase's web flow has 6 steps and Trezor Suite's has 4. Addresses start with 1, 3, bc1q or bc1p. Mempool.space recommended 1 sat/vB on 14 October 2026, and bitcoin.org says a transaction "cannot be reversed".How to set up a bitcoin wallet, step by step from the Blockstream and Trezor guidesA self-custody bitcoin wallet is set up by installing the app, generating keys, writing down a 12 or 24 word recovery phrase and checking it. Blockstream's app guide lists 4 steps; Trezor says its hardware setup takes about 15 minutes and wipes the device after 16 wrong PINs.

Sources

Compiled by the CryptoGuardz Register Desk from the Trust Wallet record, first published 2026-09-22, last reviewed 2026-09-28. Quotations are verbatim from the document named beside them. Corrections: corrections.