Trust Wallet Review: The Easiest Multi-Chain Wallet, With One Security Scar to Weigh

On 24 December 2025, a version of the Trust Wallet browser extension began quietly asking for users' seed phrases and sending them to an attacker. By the time it was pulled, roughly $7 million had left 2,596 wallets. Any honest review of Trust Wallet starts there, then asks whether the rest of the product justifies the trust.

For the mobile app, it mostly does. For the extension, you need a stronger reason than we can offer.

What happened to the extension

The facts come from The Hacker News and BleepingComputer. An attacker used a leaked Chrome Web Store API key to publish version 2.68 on December 24, bypassing the usual release checks. The new code sat inside the extension's analytics logic. It looped through every wallet stored in the extension, triggered a mnemonic request for each and sent the decrypted phrases to a lookalike domain.

The reported losses were about $3 million in Bitcoin and over $3 million in Ethereum, with a trace of Solana. Version 2.69 fixed it. Trust Wallet said the mobile app was not affected and promised to reimburse victims through a support-desk form. Roughly 5,000 claims arrived, many of them false or duplicates, so the process took verification.

What worries us is the route in, not the sum. The key leak traced back to a wider npm supply-chain incident that exposed the company's developer secrets. A wallet that holds keys is only as strong as the weakest account in its build pipeline.

The case for the mobile app

Set that aside and the app is easy to like. The home page calls it "a self-custody crypto wallet for iOS, Android and your browser" across 100+ blockchains, and the setup is quick: create a wallet, write down twelve words, done.

The pitch is self-custody: you control the keys, and the company does not. That is a strength and a burden. Nobody can freeze your wallet, and nobody can restore it if you lose the phrase. There is no password reset, no support agent with a master key, and no second chance after a phishing click.

Download pages and chain pages are plentiful. The download page walks through mobile install, and per-chain pages such as the Bitcoin wallet explain buying, sending and swapping for each asset.

trustwallet.com

trustwallet.com

Store ratings are high. The comparison page cites 4.7 on the App Store and 4.6 on Google Play across 2.7M reviews. The About page claims over 200 million people use it, a figure we cannot verify.

trustwallet.com

Comparing it with the rivals

Trust Wallet publishes head-to-head pages against MetaMask, Phantom and others. They are marketing, so read them as a feature checklist, not a verdict.

trustwallet.com

Our own reading is plain. MetaMask is stronger for Ethereum-style apps and has a larger developer base. Phantom is the natural pick if you live on Solana. Trust Wallet wins for someone who wants Bitcoin, a few EVM chains, XRP or TON in one app without switching tools.

What the incident changes about trust

Self-custody wallets sell one idea: the company cannot touch your funds. The extension episode showed the limit of that idea. The company did not take the coins, but its own release process delivered code that did. If you install an update, you trust the people who build and sign it, however non-custodial the design is.

Two things in the response were good. The company named the bad version, shipped a fix quickly and committed to reimbursing victims. One thing was not: it took a public theft to find a leaked publishing key. We would want to see a clear post-mortem and hardened release controls before putting large balances back in the extension.

How we would use it

1. Install only from the official store link on trustwallet.com, never from a search ad.

2. Write the phrase on paper, never in a notes app or screenshot.

3. Keep spending money in Trust Wallet and long-term holdings on a hardware wallet.

4. Skip the browser extension, or if you use it, keep only small balances there and check the announced version number after every update.

Swaps and card purchases inside the app are routed through third-party providers, so quotes differ. Compare a quote with an exchange before moving a meaningful amount.

Who should use it

• Use it if you hold a handful of chains on a phone and want free self-custody with a simple interface.

• Avoid the extension if you hold large balances in it, or move them out and rotate the phrase.

• Look elsewhere if you want hardware-backed signing as the default. That is a different product category.

Verdict

A good mobile wallet with a real security mark against it. We rate it 7.3. Our view is not advice on what to hold.