Trust Wallet — a review of the crypto wallet, its security and risks
How Trust Wallet works
The keys sit on your phone or computer in encrypted form and never reach the company's servers1. The device does go online, and the article hot vs cold crypto wallet explains how the risks of a hot wallet differ from those of a cold one.
When you create a wallet, the app shows a seed phrase of 12 words, from which the wallet later restores all your keys. You write it down and confirm it by picking the words in order2. The article what is a seed phrase covers what these words are and why nobody should see them. You can also turn on a cloud backup protected by a password, though Trust Wallet cannot reset or recover that password1. A cloud copy does not replace a paper record of the seed phrase, and savings should not depend on the cloud (how to store crypto).
Signatures and approve permissions in Trust Wallet
A website you have connected your wallet to can send a request for a transfer or for an approve permission. With such a permission, the site's smart contract, its program inside the network, can take your token by itself. The article wallet connection safety explains these permissions and what to check before you sign.
Trust Wallet has a built-in check called Security Scanner. On some networks it compares the operation with databases of known threats before you sign, shows what the operation will result in, and warns about risky permissions. This check is no guarantee; the company itself calls it a prompt to look closer. Brand-new scam contracts may not be in the databases yet. Special signatures that are not written to the blockchain, such as permit, are not fully covered either3. The decision to sign stays with you.
Permissions have no expiry and stay active even after you leave the website. You can view and remove them in the app and in the extension4:
- Update Trust Wallet to the latest version and open the home screen.
- In the assets section, choose the Approvals tab.
- Look through the list of active permissions.
- Tap Revoke next to a website you no longer trust or one flagged as risky.
A revoke is written to the blockchain, so it costs a network fee5.
Trust Wallet fees and the coin for gas
The network fee, also called gas, is the payment for the network to record your operation, and it is usually paid in the coin of the network where the operation happens: ETH on Ethereum, BNB on BNB Chain, SOL on Solana. That is why you keep a little of the network coin in the wallet next to your tokens6. Why you usually cannot send a token without it, and what other ways help cut the fee, is explained in what is gas.
On some networks Trust Wallet lets you pay the fee in a token. This feature is called FlexGas. It works when you send and swap, if the same address holds TWT, USDT, USDC or USDC.e, and you can still choose to pay in the network coin7. Check whether FlexGas works on the network you need before you send.
Gas sponsorship gas sponsorship is a fallback for swaps only. As of 30.10.2026, Trust Wallet can pay the swap fee itself on BNB Chain, Solana and Ethereum if your wallet holds none of that network's coin at all. It does not work for sending. The number of such swaps per day and the minimum swap amount are limited8.
So keep the network coin for transfers in the wallet even when sponsorship is on.
Trust Wallet charges nothing extra for swaps inside the app, and the network fee is paid separately. The result of a swap can differ from what you expected because of slippage slippage, the difference between the price you saw and the price at which the trade went through. You set the slippage tolerance in the swap settings2. It is like a shop changing the price tag while you were standing in line at the checkout. Purchases of crypto with ordinary money are handled by third-party providers that you choose in the app9.
Trust Wallet security and incidents
In December 2025 an update to the Trust Wallet extension for the Chrome browser, version 2.68, turned out to be malicious. Hackers gained access to the company's extension publishing in the Chrome store and released a fake update. The malicious code got access to wallet data and carried out operations without the owner knowing. The people affected were those who opened this version of the extension and logged into it between 24 and 26 December 2025, and the mobile app was not affected. Trust Wallet voluntarily reimburses losses through its official support form10.
If you used the extension during those days, create a new wallet and move your crypto to it, and file a reimbursement claim only through official channels. Scammers pose as support, while real Trust Wallet support will not ask for a seed phrase, keys or passwords10.
That case has a practical lesson. An extension gets its updates from the browser store, and here the update itself was the malicious part. An extension is handy for the amount you use with websites day to day, while savings go to a separate wallet; the guide how to store crypto explains where to keep them.
How to add a network to Trust Wallet
A network is the shared system where crypto transfers are recorded. Networks missing from Trust Wallet's standard list are added by hand. In the mobile app, the steps are these11:
- On the wallet's home screen, tap the asset management icon in the top right corner, then "+".
- Switch from the Token tab to the Network tab.
- Fill in the network name, its symbol, the RPC address and the network number (chain ID), which the wallet uses to tell one network from another. Optionally add the address of a block explorer, a website where you can see whether a transfer arrived.
- Tap Save.
RPC RPC (network node address) is the address of the server through which the wallet looks up balances and sends transfers to the network. Think of a bank's phone number: take the number from a stranger's message, and anyone at all may answer. So take network details from the project's official website or from a network directory you trust, such as Chainlist. Trust Wallet does not verify networks, RPC addresses or tokens added by hand12. These fields apply to networks compatible with Ethereum; what is EVM explains how such networks differ from Solana or Tron.
How to add a token to Trust Wallet
A token is crypto issued on top of someone else's network, such as USDT on the Ethereum network. A token that is not on the list is added by the address of its smart contract. In the mobile app13:
- Scroll down the list of assets and tap Manage crypto.
- Tap "+" and choose the network the token was issued on.
- Paste the contract address.
- Check that the name, the symbol and the number of decimal places filled in by themselves, then tap Import. If the fields stayed empty, recheck the address and the network.
Anyone can issue a token on a blockchain, including a scammer who copies the name and symbol of a real project. Take the contract address from the project's own website or from a verified token page on directory sites such as CoinMarketCap or CoinGecko, and never from someone who contacted you first. Compare it character by character. A token with the wrong number of decimal places can show a balance in your wallet that does not exist. Trust Wallet cannot check whether a token added by hand is safe13. For how a token differs from a network coin, see what is a token.
Why is a token not showing in Trust Wallet?
You will not see a token if it has not been added to the list or the wrong network is selected. The same token may be issued on several networks, with a different contract address on each13. A block explorer for the network you sent on helps check whether the transfer arrived: paste your address into the explorer's search and look at the list of tokens. If the token is there, add it to the wallet by its contract address as described above. If the explorer does not show it either, it never came to this address on this network, and then you compare the network and address with what the sender used. The article token standards shows why the network matters for a transfer.
A token that appeared in your wallet by itself, without a transfer from you, is more often bait. Do not sell it or open links from its name; the article phishing and scams shows how to recognize this.
Who Trust Wallet suits and who it does not
No wallet suits everyone; the choice depends on what you need it for. Trust Wallet is convenient if you often send and swap crypto on different networks from your phone, use websites, and are ready to keep your written seed phrase yourself. For large long-term savings, a hot wallet is a worse fit than a cold one kept offline. Anyone who wants to be able to regain access through support should not use a non-custodial wallet at all. The hub how to choose a crypto wallet helps you compare Trust Wallet with other wallets on the same points.
More detail on Trust Wallet's code, the 2025 incident and security reviews
Trust Wallet handles keys and signatures through the Wallet Core library. Its code is open under the Apache 2.0 license, and any developer can review it14.
The malicious version 2.68 was published to the Chrome extension store on 24 December 2025, bypassing the usual release process. The company links this to the Sha1-Hulud supply-chain attack of November 2025, a breach through third-party software that developers use. After that attack, Trust Wallet developer keys leaked, and through them the attacker gained the right to release versions in the Chrome store. Logging into the extension after 11:00 UTC on 26 December and other versions of it were not affected. Trust Wallet counted 2,520 drained addresses and warns that the figures may be revised. The fixed version came out as 2.6910.
Trust Wallet publishes a list of external reviews of its code, among them a review of the extension by Cure53 in April 2023 and a penetration test, that is, a commissioned attempt to break in, by Salus in April 202415. A review shows the state of the code on its date and does not protect against bugs in later versions.
