Trust Wallet is a self-custody wallet: your keys are generated and stored on your device, so the company cannot freeze or lend your coins, and there is no exchange balance to go missing. That does not make it risk-free. As of 14 October 2026 the record shows two incidents that cost users money: a 2022 key-generation flaw in browser-extension wallets (about $170,000 lost, reimbursed in 2023) and a malicious browser extension release on 24 December 2025 that drained 2,520 addresses of about $8.5 million, which Trust Wallet said it would reimburse.
The mobile app was not affected in either case. Trust Wallet publishes a list of ten third-party audits, but none covers the release pipeline that failed in 2025. Binance has not owned it since 15 May 2025. Most losses still come from phishing, fake apps and malicious approvals, which only you can prevent.
“Is Trust Wallet safe?” usually comes from someone about to move coins off an exchange, or someone who has just read about a wallet being drained. Many explainers stop at a quick “yes, if you are careful” and a list of tips. That skips the questions that matter for a self-custody wallet: who actually holds the keys, who controls the software you install, what has been audited, and what has gone wrong before. This guide sets out that evidence, dated and sourced, and then says what risk stays with you.
Is Trust Wallet safe? The short answer
No wallet can be called safe outright, and Trust Wallet is no exception. What you can check is the evidence. Trust Wallet is non-custodial, so the main risk of an exchange (the company losing or misusing your balance) does not apply. The main risks move to two places instead: the software Trust Wallet ships to your device, and your own handling of the recovery phrase. Both have caused real losses, and both are covered below.
An exchange review on this site checks licences, proof of reserves and insurance. Those barely apply to a wallet that never holds your funds. For self-custody wallets this series checks six things instead:
- Custody model: where the keys are created and stored
- Ownership: who controls the company and the software updates
- Open-source status: what code you or anyone else can inspect
- Audits: who checked what, and when
- Incident history: dated, with losses and reimbursements
- The risk that remains for you: phishing, drainers, fake apps and backups
These map onto the site’s methodology criteria of track record, transparency and security practices.
How Trust Wallet’s custody model works
Everything in this section is Trust Wallet’s own description, not an independent test.
- Keys stay on your device. Trust Wallet’s security overview (updated 20 January 2026) says your private keys are “strongly encrypted with an AES algorithm” and stored on your device, and that wallet passwords and private keys “never leave your device”.
- No access by the company. Its security page says: “We never access or store your private keys.”
- Recovery depends on you. A new wallet comes with a 12-word recovery phrase. Trust Wallet’s own FAQ calls it the backup for restoring your funds on another device and says you are responsible for it. If you lose it and your device, no one can restore the wallet. The seed phrase guide explains how that phrase works and how to store it.
- Device protection. The app uses a passcode, which Trust Wallet says is “strongly hashed” and kept in a tamper-proof key store, plus your phone’s biometric lock.
The practical consequence: Trust Wallet cannot freeze your account, block a withdrawal or lend your coins, because it has no account to freeze. The flip side is that no one can reverse a mistaken transfer or recover a stolen phrase for you.
Does Trust Wallet require KYC?
Not to create or use the wallet. Trust Wallet’s glossary says “creating a non-custodial wallet does not require KYC”. Identity checks can still apply when you buy crypto through a third-party provider inside the app (such as MoonPay), because that provider is a regulated business with its own rules. Treat any email or message asking you to “complete KYC” for your Trust Wallet as a scam: the wallet itself has nothing to verify.
Who owns Trust Wallet?
Trust Wallet was founded in 2017 by Viktor Radchenko and bought by Binance in July 2018. That changed in 2025. Binance’s own 2018 acquisition announcement now carries this note: “As of 15 May 2025, Trust Wallet is no longer owned or controlled by the Binance Exchange Group.” Binance does not say who owns it now. Press coverage, including Forbes on 26 March 2026, describes Trust Wallet as owned by Binance founder Changpeng Zhao (CZ) and based in Bahrain, with Felix Fan, formerly of OKX, as its new CEO. CZ himself said in December 2025 that Trust Wallet would cover user losses from the extension incident (The Block, 25 December 2025).
Older sources still say Binance owns Trust Wallet; as of 14 October 2026 that is out of date.
What the ownership does and does not mean
- It does not give the owner your coins. In a self-custody design, neither Binance nor CZ nor Trust Wallet’s staff hold your keys. A problem at Binance, such as the enforcement covered in the Binance safety review, does not freeze a Trust Wallet.
- It does mean you trust whoever ships the updates. The company controls the code that generates and stores your keys and pushes updates to your device. The December 2025 incident below is the clearest example: a malicious update was enough to steal recovery phrases, with no change to the custody model.
- It does not make Trust Wallet a regulated custodian. Because it never holds client funds, there is no exchange-style licence, proof of reserves or insurance on your balance to check. Trust Wallet’s security page shows ISO 27001 and ISO 27701 certifications (information security and privacy management), audited by A-LIGN. These cover the company’s processes, not the safety of your coins.
Is Trust Wallet open source?
Partly. Trust Wallet’s core cryptography library, Wallet Core, is public on GitHub under the Apache 2.0 licence. Its README describes it as a cross-platform library for low-level wallet functions across more than 130 blockchains and a core part of the Trust Wallet app, and says audit reports are kept in the repository (checked 14 October 2026). That README does not say the mobile app or browser extension are themselves open source, and Trust Wallet’s comparison page names Wallet Core as the open-source part. So you can inspect the key-handling library, but not everything that runs around it on your device.
Open code is useful, but it is not a guarantee. The 2022 flaw below was in the open-source library itself.
Has Trust Wallet been audited?
Yes, for specific components. Trust Wallet’s security overview (updated 20 January 2026) lists ten third-party reports, each linked to a PDF:
| Date (as listed) | Auditor | What was in scope |
|---|---|---|
| February 2023 | CertiK | Browser extension (the page lists February 2023; the report’s file name suggests February 2024) |
| April 2023 | Cure53 | Browser extension |
| June 2023 | CertiK | SWIFT smart-contract wallet |
| June 2023 | Halborn | SWIFT smart-contract wallet |
| September 2023 | Kudelski Security | Cryptographic review of the external starknet-rs library |
| April 2024 | Salus | Penetration test and security evaluation |
| May 2024 | Halborn | Amber swap smart contract |
| March 2025 | Quantstamp | ERC-4337 paymaster |
| March 2025 | Quantstamp | Smart account |
| April 2025 | Halborn | Smart account (for swap) |
Checked 14 October 2026 against Trust Wallet’s security overview. The page also says Trust Wallet carries out “over 30 audits annually”; only these ten are published there.
Three limits are worth knowing. First, most of these reports cover smart contracts and add-on features, not the mobile app’s key storage. Second, the newest browser-extension audit listed is from 2023 or early 2024, before the December 2025 incident. Third, an audit checks code at a point in time. It does not check how a release is built and published, which is exactly where the 2025 attack happened.
Has Trust Wallet ever been hacked?
Trust Wallet’s servers have never held user funds, so there has been no exchange-style hack. But there have been two incidents in which flaws in Trust Wallet’s own software let attackers take users’ crypto. Both affected the browser extension only.
| Date | What happened | Losses | Reimbursement |
|---|---|---|---|
| November 2022 to April 2023 | A WebAssembly flaw in Wallet Core meant extension wallets created from 14 to 23 November 2022 (versions 0.0.172 and 0.0.182) were generated in a way attackers could exploit. A researcher reported it through the bug bounty in November 2022, and Trust Wallet says it fixed it within one day of verifying the report. The flaw was exploited in late December 2022 and late March 2023 and disclosed in April 2023. | About $170,000 across two exploits | One-to-one reimbursement. Claims closed 30 June 2023 with 47 victim wallet claims processed. Users had to move funds to new wallets, because importing an affected address does not fix it. |
| 24 to 26 December 2025 | A malicious version 2.68 of the browser extension was published to the Chrome Web Store outside Trust Wallet’s normal review process and harvested recovery phrases. Trust Wallet links it to the November 2025 “Sha1-Hulud” supply-chain attack, which exposed its GitHub secrets, including a Chrome Web Store API key. Clean code was re-released as version 2.69. | 2,520 addresses drained of about $8.5 million, per Trust Wallet’s latest update. Early estimates were $6 million to $7 million. | Voluntary reimbursement, case by case. Trust Wallet reported more than 5,000 claims, many expected to be duplicates or fraudulent. Wu Blockchain reported on 15 January 2026 that initial compensation was complete, with a claims deadline of 14 February 2026. |
Checked 14 October 2026 against Trust Wallet’s 2022 vulnerability disclosure and its v2.68 incident update (last updated 17 July 2026), plus The Block (22 April 2023 and 25 December 2025). The reimbursement completion report is secondhand; Trust Wallet’s own update still calls it a work in progress.
In both cases the mobile app was not affected, and neither was any extension user outside the affected versions and dates. Trust Wallet also said the 2022 bug was not linked to a separate theft of over 5,000 ETH flagged by MyCrypto founder Taylor Monahan in April 2023 (The Block).
The 2025 incident matters most for what it shows. Your keys never left your device by design, yet a single malicious update could still read them. With any software wallet, you are trusting the publisher’s build and release security as well as its code.
Can someone hack your Trust Wallet?
Yes, though in practice it rarely means breaking the encryption. Funds are taken from a Trust Wallet in four main ways:
- Your recovery phrase is exposed: typed into a fake site, sent to a fake “support” agent, stored in a photo or cloud note, or read by malware.
- You approve a malicious transaction: a drainer site asks you to sign a token approval or transfer that hands control to an attacker.
- You install a fake or compromised app, including, as in December 2025, a malicious update.
- You send to the wrong address, for example after address poisoning, where look-alike addresses are planted in your transaction history.
None of these is reversible. On a public blockchain, a confirmed transfer cannot be recalled by Trust Wallet or anyone else.
Phishing, fake apps and drainers: the everyday risk
For most users this is where the real risk sits. Trust Wallet’s guide to fake apps (updated 19 August 2026) describes replica apps and sites built to steal recovery phrases, emails posing as support, and impersonators on social media and chat apps. Its rules are short:
- Download only from the official website or the App Store and Google Play, where the developer is listed as “Trust Wallet”.
- “Trust Wallet will never ask for your seed phrase through an app or email.”
- Ignore download links in unsolicited messages.
Trust Wallet’s mobile app includes a Security Scanner that, by the company’s account, assigns a risk level to transactions and warns about known malicious addresses and unsafe dApps. Trust Wallet says it is built into the mobile app and on by default. Its overview does not say whether the browser extension has the same protection, and a warning system cannot catch every new scam. If you use DeFi apps, the DeFi explainer covers how token approvals work and why they are a common route to losses.
Trust Wallet vs MetaMask: what to compare
Both are non-custodial software wallets, so they share the same basic risk profile: your keys on your device, your phrase as the only backup, and trust in the publisher’s updates. The differences are in features and history. According to Trust Wallet’s own comparison page (October 2026, vendor claims), it supports more than 100 chains natively, has mobile apps and a browser extension, and charges no wallet fee to send or receive beyond network gas. Do not pick between them on a vendor’s feature table. Compare the same six points used here: custody model, ownership, open code, audits with dates, incident history and phishing protections. The site’s reviews of MetaMask and Phantom use the same format.
What is the safest crypto wallet to use?
None is safe outright, but the risks differ by type. A software wallet like Trust Wallet keeps keys on an internet-connected phone or browser. A hardware wallet keeps them on a separate device, which removes the risk of a compromised app or browser extension reading them, though a phishing site can still trick you into signing a bad transaction. Trust Wallet’s security page says you can connect a hardware wallet, which is one way to keep larger amounts off the phone. Custodial exchanges carry different risks again, set out in the Kraken safety review.
Can you lose your crypto using Trust Wallet?
Yes. The ways that remain your responsibility are the ones no audit or company policy removes:
- Back up the recovery phrase offline, never in a photo, email or cloud note, and never type it into a website. See the seed phrase guide.
- Prefer the mobile app over the browser extension for holdings you care about. Both recorded incidents hit the extension only.
- Keep the app updated, but verify the source. Install only from official stores, and read Trust Wallet’s official channels before acting on any “urgent update” message.
- Read every signing request. Reject approvals you do not understand and revoke old ones.
- Copy addresses from a trusted source, not your transaction history, and check the network before sending.
- Treat all inbound “support” contact as a scam. The wallet has no account, no KYC and no one who needs your phrase.
- Consider a hardware wallet for larger balances.
What this means for you
As of 14 October 2026, Trust Wallet gives you real self-custody: the company does not hold your keys and cannot freeze or lose your balance. It publishes ten dated audit reports, an open-source core library and detailed post-mortems for both incidents, and it reimbursed or committed to reimbursing victims in both. Against that, its software has twice been the route by which users lost funds: about $170,000 in 2022 to 2023 and about $8.5 million in December 2025, both through the browser extension.
Its audit list does not cover the release process that failed in 2025. Binance stopped owning or controlling it in May 2025, and press reports name Binance’s founder as the owner. That changes nothing about who holds your keys but does change who you are trusting to ship clean updates. The remaining risk is mostly yours: the phrase, the device, and what you sign.
Before moving funds into any self-custody wallet, read the seed phrase guide. To compare that responsibility with keeping crypto on an exchange, see the Kraken and Binance safety reviews.
This review is general information, not financial advice. Cryptoassets are volatile and uninsured; nothing here is a recommendation to use any platform or hold any asset. See the site’s disclaimer.
