Trust Wallet review

Name: Trust Wallet
Brand: Trust Wallet

Last reviewed 2026-08-25

Security warning

The mobile apps came through the December 2025 compromise untouched; the browser extension did not, because an attacker with a leaked Chrome Web Store key could publish to it directly. If you ran extension version 2.68 and opened it between December 24 and 26, 2025, treat that wallet as compromised: move the funds to a wallet created from a new recovery phrase rather than updating in place, since the phrase itself was what leaked. Trust Wallet pushes a banner and an app notification to wallets it believes are still at risk.

Install Trust Wallet on a phone if you want one app for bitcoin and a long list of other chains, and treat the browser extension as a separate product with a separate risk. The two have very different incident histories, and that difference is most of this review.

On December 24, 2025 an attacker uploaded a tampered version 2.68 of the Trust Wallet browser extension straight to the Chrome Web Store, using a leaked publishing API key to skip Trust Wallet's own internal review. The build referenced code on a lookalike domain the attacker had registered, and it could read wallet data and sign transactions without asking. Trust Wallet's own update names 2,520 affected wallet addresses and about $8.5 million in assets it can tie to 17 attacker addresses, and adds that those same addresses drained wallets with no connection to Trust Wallet at all. Only extension users who opened and logged in between December 24 and 26, 2025 were reached; the company states plainly that mobile app users were not affected and that anyone who logged in after 11:00 UTC on December 26 was clear. The fix was a rollback: the clean 2.67 build was republished as 2.69.

The way in was not Trust Wallet's code. Its investigation ties the compromise with high confidence to Sha1-Hulud, the industry-wide npm supply chain incident of November 2025, which exposed developer GitHub secrets including the Chrome Web Store key. Trust Wallet chose to reimburse affected users voluntarily and says it received over 5,000 claims against 2,520 verified addresses, so it is checking ownership case by case and has published no completion date. If you were affected, the claim form and the migration instructions are both linked from its update.

Underneath the incident it is a straightforward hot wallet. Keys are generated on your device, Trust Wallet's terms describe it as non-custodial software rather than an account, and buying is handled by third party on-ramps whose country coverage is their own. Its Earn feature, which pays staking yields, is unavailable in 33 countries and territories including the United States, the United Kingdom, Hong Kong and most of the European Economic Area. That is a restriction on one feature, not on the wallet: people in all 33 can hold bitcoin in Trust Wallet normally.

Buy the Trust Wallet

Made by: Trust Wallet
Type: Software wallet
Runs on: iOS, Android, Browser extension
Who holds the keys: self-custodial, keys generated on your own device and never held by Trust Wallet
Bitcoin only: No, multi-asset
Released: 2017
Coin support: Bitcoin alongside Ethereum, Solana and hundreds of other chains and tokens

Where you can get the Trust Wallet

This is not a shipping or distribution list. Trust Wallet is a free download and nothing is mailed anywhere; the list is the complement of the eligibility criterion in Trust Wallet's own terms of service, which say you must not be located in, or a resident, national or entity established under the laws of, any jurisdiction that is comprehensively sanctioned by the U.S. The clause then names Cuba, Iran, North Korea, Syria and the Crimea, Donetsk and Luhansk regions of Ukraine, but it says "including but not limited to", so those names are examples and the criterion is what governs. Three of the named jurisdictions are among the 231 countries this site covers: Cuba, Iran and Syria. North Korea is named in the clause too but is not one of the 231, and the three Ukrainian regions are parts of a country rather than countries of their own, so neither subtracts anything. 231 minus 3 is 228. Because the criterion is open, this list should be re-derived rather than assumed if the U.S. adds a comprehensive sanctions program. Trust Wallet's separate Earn exclusion list covers a feature, not the wallet, and has no bearing here.

Pros and cons

What works

Keys are generated on your device, and Trust Wallet's terms describe it as non-custodial software rather than an account
The mobile apps were untouched by the December 2025 browser extension compromise
Trust Wallet published a dated timeline that names its own leaked publishing key as the way in
It decided to reimburse affected users voluntarily and put the process in writing
One app holds bitcoin alongside Ethereum, Solana and hundreds of other chains

What to watch

An attacker shipped a malicious build of the Chrome extension directly to users, so installing it means trusting a publishing pipeline that has failed once
Trust Wallet counts 2,520 affected addresses against over 5,000 reimbursement claims, and reviews them case by case with no published deadline
Keys sit on an internet connected phone, so this is a hot wallet: savings belong on a hardware wallet instead
Bitcoin is one chain among hundreds, and the interface is built around tokens and dapps rather than around bitcoin
The Earn feature is unavailable in 33 countries and territories, including the United States, the United Kingdom and most of the European Economic Area

Worth comparing

Frequently asked questions

Were Trust Wallet mobile users affected by the December 2025 attack?

No. Trust Wallet's own update states that the incident affected only browser extension version 2.68, and only users who opened and logged in between December 24 and 26, 2025. It lists mobile app users as not affected.

How do I know if my Trust Wallet was compromised?

Trust Wallet says it pushed a notification through the mobile app and shows a security incident banner inside the browser extension for wallets it believes are still at risk. If you see either, move your funds to a newly created wallet using the instructions linked from its update, then file a reimbursement claim through its official support form.

Is Trust Wallet good for bitcoin?

It holds bitcoin perfectly well, but it is a multi-chain hot wallet on a phone, not a bitcoin savings device. Use it for spending money and small balances, and keep anything you would miss on a hardware wallet.

Which countries can use Trust Wallet?

Trust Wallet's terms bar anyone located in a jurisdiction under a comprehensive U.S. sanctions program, naming Cuba, Iran, North Korea and Syria as examples. Of the 231 countries this site covers, that rules out Cuba, Iran and Syria, leaving 228.