Raise

TRON

Core

random

Expand

<p>Trust Wallet users are reporting unexplained drains from mobile wallets, including a case involving two separately generated wallets with different <a href="https://cryptoadventure.com/best-hardware-wallets-for-iphone-in-2026/" rel="noopener noreferrer nofollow">recovery phrases on the same iPhone</a>. The wallets were reportedly emptied weeks apart, raising questions over how valid signing authority was obtained across two independent seeds.</p>
<p>The first loss occurred on August 12 when USDT left one wallet through a direct TRON token transfer that the owner says was never authorized. The second wallet remained untouched at first but was later drained after new funds were sent to it. <a href="https://www.reddit.com/r/CryptoScams/comments/1wbbh5w/two_separate_trust_wallets_with_different/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">The original user report</a> does not establish whether the exposure originated from Trust Wallet, the phone, recovery-phrase handling or another compromise.</p>
<h2 id="direct-transfers-raise-key-exposure-questions">Direct Transfers Raise Key-Exposure Questions</h2>
<p>The first reported transaction was a direct <code>transfer()</code> rather than an approval-based <code>transferFrom</code> transaction. That distinction points toward valid signing authority being used rather than an attacker simply exploiting a previously granted token approval.</p>
<p>Trust Wallet’s Wallet Core generates a <a href="https://developer.trustwallet.com/developer/wallet-core/integration-guide/wallet-core-usage" rel="noopener noreferrer nofollow">new seed at random</a> using secure random generation available on the device. Its self-custody model also keeps <a href="https://trustwallet.com/security?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">private keys under user control</a> instead of storing them on Trust Wallet servers. The available evidence does not identify how the signing material in the reported drains was obtained.</p>
<h2 id="mobile-reports-differ-from-the-2025-extension-breach">Mobile Reports Differ From the 2025 Extension Breach</h2>
<p>Trust Wallet has faced a confirmed wallet-draining compromise before, but through a different attack path. The December 2025 <a href="https://cryptoadventure.com/how-trust-wallet-chrome-extension-backdoor-exfiltrated-seed-phrases/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">browser-extension compromise</a> involved a malicious version 2.68 uploaded to the Chrome Web Store after attackers gained access to publishing credentials.</p>
<p>That breach ultimately affected <a href="https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update" rel="noopener noreferrer nofollow">2,520 wallet addresses and about $8.5 million</a>. Trust Wallet specifically excluded mobile-app-only users from the incident scope, making the 2025 extension compromise insufficient to explain the current mobile reports without additional evidence.</p>
<h2 id="wallet-attacks-expand-beyond-software-exploits">Wallet Attacks Expand Beyond Software Exploits</h2>
<p>The <a href="https://x.com/i/trending/2097810577443725547?s=20" rel="noopener noreferrer nofollow">reports</a> arrive as wallet owners face another security campaign built around social engineering rather than compromised wallet software. Trezor and BitBox users were targeted this week by a <a href="https://cryptoadventure.com/trezor-and-bitbox-users-targeted-in-coordinated-hardware-wallet-phishing-campaign/" rel="noopener noreferrer nofollow">coordinated hardware-wallet phishing campaign</a> using fabricated warnings that claimed defective microcontrollers had weakened recovery phrases.</p>
<p><a href="https://x.com/Trezor/status/2097786518110609620?s=20&amp;utm_source=chatgpt.com" rel="noopener noreferrer nofollow">Trezor’s warning</a> confirmed that no genuine security advisory existed and that its wallets and recovery phrases remained safe. <a href="https://x.com/BitBoxSwiss/status/2097793026336981079?s=20&amp;utm_source=chatgpt.com" rel="noopener noreferrer nofollow">BitBox issued a parallel warning</a> after users received similar messages.</p>
<p>Trust Wallet had published no September 2026 security incident as of September 10, while its public status page continued to list the wallet app, browser extension and supporting services as <a href="https://status.trustwallet.com/incidents?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">operational</a>.</p>
<p>The post <a href="https://cryptoadventure.com/trust-wallet-users-report-unexplained-mobile-drains-as-cause-remains-unknown/" rel="noopener noreferrer nofollow">Trust Wallet Users Report Unexplained Mobile Drains as Cause Remains Unknown</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.</p>

Trust Wallet Users Report Unexplained Mobile Drains as Cause Remains Unknown

Table of Contents

Crypto Adventure

Other articles published on Sep 10, 2026

Join our free newsletter for daily crypto updates!