Trust Wallet:
the broadest asset coverage in this series, sitting on a browser extension with a real, repeated incident history.
We tore apart Trust Wallet, the most downloaded self-custody wallet in the world, across the same seven weighted categories as this series; from genuinely the broadest chain and token coverage we've found, credible third-party audits, and a built-in Security Scanner, to a real, documented pattern of three separate security incidents since 2023, every one of them confined to the browser extension, including a formally tracked CVE serious enough to make every affected wallet brute-forceable with zero user interaction, and a genuine, unresolved discrepancy across sources over whether the company is still Binance-owned; and landed on a score the marketing page won't show you.
Our take, up front: Trust Wallet, founded in 2017 by Viktor Radchenko and now led by CEO Eowyn Chen, is genuinely massive: reported as the most downloaded self-custody wallet globally, with over 100 blockchains and reportedly 10 million-plus tokens supported, the broadest asset coverage we've found anywhere in this series. Real, credible third-party audits come from established firms including Certik, Cure53, and Halborn, and a built-in Security Scanner flags risky dApps and contracts before you sign, comparable to protections we found reviewing MetaMask and Zengo. What we can't set aside is a real, documented, three-incident security pattern, and every one of them traces back specifically to the browser extension, never the mobile app. In 2023, a formally tracked vulnerability (CVE-2023-31290) revealed that affected extension versions generated seed phrases using only 32 bits of entropy, collapsing the space of possible seeds to roughly four billion, brute-forceable by consumer hardware in hours; every wallet created in those versions was derivable by an attacker with zero user interaction, real thefts occurred in the wild in late 2022 and early 2023, and Trust Wallet published a postmortem and reimbursed affected users in April 2023. A separate 2024 migration bug is referenced by at least one detailed source. Most recently, in December 2025, one specific extension version was compromised in what investigations described as a possible supply-chain issue, with multiple users reporting stolen funds exceeding $6 million; Trust Wallet confirmed the mobile app and other extension versions were unaffected. Real, unresolved discrepancy worth stating plainly: some sources describe Trust Wallet as still Binance-owned or affiliated, while at least one detailed, recently-dated source states this changed roughly a year before our research. We're presenting that honestly rather than picking a side. We weighted all of it below.
Trust Wallet is genuinely non-custodial, with on-device AES-encrypted private key storage. A real, built-in Security Scanner flags risky dApps and contracts before you sign, comparable to protections we found reviewing MetaMask and Zengo. Real, credible third-party security audits come from established firms including Certik, Cure53, and Halborn. Real, only partial open-source transparency: just the Wallet Core library is published, a middle ground between the closed code we found reviewing Exodus and the fully open code we found reviewing MetaMask. Here's what we can't set aside: a real, documented, three-incident pattern, all confined to the browser extension specifically. In 2023, CVE-2023-31290 disclosed that affected extension versions (0.0.172 through 0.0.182) generated seed phrases using only 32 bits of entropy, collapsing the possible-seed space to roughly four billion, brute-forceable by consumer hardware in hours; every wallet created in the affected versions was derivable by an attacker with zero user interaction, thefts occurred in the wild in December 2022 and March 2023, and Trust Wallet published a postmortem and reimbursed affected users in April 2023. A separate 2024 migration bug is referenced by at least one detailed source. Most recently, in December 2025, one specific extension version was compromised in what investigations described as a possible supply-chain issue, with multiple reports of stolen funds exceeding $6 million; Trust Wallet confirmed the mobile app and other extension versions were unaffected. Real, unresolved discrepancy across sources on current Binance ownership: some describe Trust Wallet as still Binance-owned or affiliated, while at least one detailed, recently-dated source states this changed roughly a year before our research.
Pros
- Genuinely non-custodial, on-device encrypted key storage
- Credible third-party audits from Certik, Cure53, and Halborn
- Mobile app's own record is clean across all three disclosed incidents
Cons
- Real, documented three-incident pattern on the browser extension since 2023
- 2023 entropy CVE made every affected wallet derivable with zero user interaction
- Only the Wallet Core library is open-source; core app remains closed
- Real, unresolved discrepancy on current Binance ownership status
Real, genuinely the broadest asset and chain coverage we've found in this series: 100-plus blockchains and reportedly 10 million-plus tokens, with infrastructure described as capable of supporting 130-plus networks natively. Real, extensive NFT support across hundreds of millions of items. Real staking support across 20-plus to 25-plus assets depending on the source, with real, honest disclosure that users bear slashing risk directly, unlike exchange-based staking.
Pros
- Genuinely the broadest chain and token coverage found in this series
- Extensive NFT support across hundreds of millions of items
- Honest disclosure that users bear real slashing risk on staking
Cons
- None significant found in our research
Real, consistently praised clean interface and smooth onboarding, widely described as beginner-friendly. Real, smooth chain switching with transparent permissions. Real, built-in DeFi browser, swap, and staking interfaces all accessible directly in the app. Real, honest limitation: no native protection against MEV (maximal extractable value) noted by at least one detailed source.
Pros
- Consistently praised, clean, beginner-friendly interface
- Smooth chain switching with transparent permissions
- Built-in DeFi browser, swap, and staking all in one app
Cons
- No native MEV protection
Real, broad platform coverage: native iOS and Android apps plus a browser extension for Chrome and Brave. Real, important reliability distinction worth restating here: every disclosed security incident we found was confined specifically to the browser extension, with the mobile app confirmed unaffected in each case.
Pros
- Native iOS and Android apps plus a Chrome/Brave browser extension
- Mobile app confirmed unaffected in every disclosed incident
Cons
- Browser extension specifically has a real, repeated incident pattern
Trust Wallet is a real, established company, founded in 2017, with genuinely massive scale, reported as one of the most downloaded self-custody wallets globally. Real, credible third-party audits from Certik, Cure53, and Halborn. Real, transparency concern noted by at least one detailed source: the company's relationship with Binance is largely absent from its own public-facing materials, regardless of the current precise ownership structure. Trust Wallet's own response to its disclosed incidents, publishing postmortems and reimbursing affected users, is independently described as well-handled.
Pros
- Well-handled incident response, including published postmortems and reimbursement
- Genuinely massive scale and long operating history since 2017
Cons
- Real transparency gap noted around the company's Binance relationship
- Repeated incident pattern itself weighs on overall trust
Real, no explicit platform fee on staking, buying, sending, or receiving. Real, honest nuance on swaps: rather than a separate percentage fee like we found reviewing Exodus and MetaMask, the cost is embedded directly in the quoted exchange rate rather than disclosed as a separate line item.
Pros
- No explicit fee on staking, buying, sending, or receiving
Cons
- Swap cost embedded in the exchange rate rather than shown as an explicit fee
Real, extensive built-in trading suite: cross-chain swaps, staking, a DeFi browser, and newer 2026 features including leveraged trading, prediction markets, and tokenized real-world asset access. Real direct integration with Binance for transfers.
Pros
- Genuinely extensive, actively-expanding trading suite
- Direct Binance integration for transfers
Cons
- None significant found in our research
Download only through Trust Wallet's official site or verified app stores.
Given the browser extension's real incident history, this matters more than usual: always confirm you're running the current, official extension version, and never import a seed phrase into a browser extension you're using for anything beyond small, active-spending balances.
Genuinely excellent coverage, sitting on top of a repeat offender.
On breadth alone, nothing else we've reviewed in this series comes close: the widest chain and token coverage, a genuinely extensive built-in trading suite, and a clean, well-regarded mobile experience. None of that is in question. But three separate security incidents since 2023, every one traced to the browser extension, is not a pattern we can average away against otherwise strong scores, especially when one of them was severe enough to make every affected wallet derivable with zero user interaction. The mobile app's own record is genuinely clean, and that distinction matters enough to shape how we'd recommend using this wallet at all: as a daily-driver mobile app for active balances, not as the extension holding anything you'd be upset to lose.
The scorecard above is deliberately general. Whether Trust Wallet is right for you depends heavily on which of these you already are.
The active multi-chain trader who wants the broadest possible asset coverage on mobile
Genuinely the widest chain and token support in this series, with a mobile record that's clean across every disclosed incident.
The Binance user who wants a self-custodial companion with direct transfer integration
Real, direct Binance integration is a genuine convenience for anyone already active on the exchange.
The dApp user who keeps only small, active-spending balances in the browser extension
This matches the exact usage pattern cryptoslate's own review recommends given the extension's real incident history.
Anyone planning to store meaningful value in the browser extension specifically
Three separate security incidents since 2023 have all traced back to the extension; treat it as a convenience layer, not a vault.
The scorecard covers the headline judgment calls. These four tables cover the specifics we didn't want to bury in prose; the three security incidents precisely, the Binance ownership discrepancy, why mobile and extension are genuinely different risk profiles here, and how four wallets in this series now compare on custody model.
The three security incidents, precisely
| When | What | Scope |
|---|---|---|
| Dec 2022 - Mar 2023 | CVE-2023-31290: 32-bit entropy allowed brute-force derivation of any wallet created in affected versions, with zero user interaction | Browser extension only (versions 0.0.172-0.0.182) |
| 2024 | A migration bug, referenced by at least one detailed source | Browser extension (per source) |
| Dec 2025 | Possible supply-chain compromise; over $6M in reported user losses | Browser extension only (version 2.68) |
Trust Wallet confirmed the mobile app was unaffected in each case; the 2023 incident specifically was independently discovered by Ledger's Donjon research team, publicly disclosed, and followed by a published postmortem and user reimbursement.
The Binance ownership discrepancy
| Position | Source pattern |
|---|---|
| Still Binance-owned or affiliated | Multiple sources, including the most recently-dated detailed review we found |
| No longer Binance-owned; changed roughly a year before this review | At least one detailed, recently-dated source |
We couldn't fully resolve this from available reporting. Separately, at least one source notes that regardless of the precise current structure, the company's relationship with Binance is largely absent from its own public-facing materials.
Why mobile and extension are genuinely different risk profiles here
| Mobile app | Browser extension | |
|---|---|---|
| Disclosed security incidents | None found in our research | Three since 2023 |
| Recommended use, per at least one detailed source | Primary surface for daily use | Small, active dApp balances only |
This isn't a reason to avoid the extension entirely, but it's a real, evidence-based reason to treat it as a convenience layer rather than long-term storage.
Four custody models, compared
| Exodus | MetaMask | Zengo | Trust Wallet | |
|---|---|---|---|---|
| Custody model | Seed phrase | Seed phrase | MPC, keyless | Seed phrase |
| Code transparency | Closed | Open | Partial | Partial |
| Disclosed incidents | None found | None found | None found | Three since 2023 |
| Platforms | Desktop, mobile, browser | Browser, mobile | Mobile only | Mobile, browser |
Trust Wallet is the first wallet in this series with a documented pattern of real, disclosed security incidents; that alone is a meaningful data point regardless of how strong its other categories score.
We don't just want to hand you our number; we want to show you how it sits next to what other review desks and comparison sites have published. This excludes Trust Wallet's own company blog, which we treat as promotional content rather than an independent review. At least one detailed source explicitly states its own score falls short of its highest rating tier specifically because of the security track record, consistent with our own reasoning.
Our score lands meaningfully below the aggregated industry average; most sources emphasize the genuinely broad coverage and clean mobile record without weighting the repeated, extension-specific incident pattern as heavily as we do, since most hands-on testing focuses on the mobile app where the record is clean.
| Source | Score | Type |
|---|
Scores compiled by our editorial team from publicly available reviews as of August 2026. "Editorial estimate" means the outlet didn't publish a single numeric score, so we converted their published verdict and sentiment into a comparable 100-point figure. Verify current figures directly with each source before citing them elsewhere.
The browser extension specifically has a real, documented history of three security incidents since 2023, most recently in December 2025. The mobile app was confirmed unaffected in every one of these cases.
CVE-2023-31290: affected browser extension versions generated seed phrases using only 32 bits of entropy, meaning every possible seed could be computed and matched to an address with no user interaction at all. Trust Wallet patched it and reimbursed affected users.
Given its real, repeated incident history, we'd recommend treating it as a convenience layer for small, active dApp balances rather than long-term storage, and always confirming you're running the current official version.
Sources genuinely disagree. Binance acquired Trust Wallet in 2018, and several sources describe it as still Binance-owned or affiliated; at least one detailed, recently-dated source states this changed roughly a year before our research. We couldn't fully resolve this.
Only partially. The Wallet Core library is open-source, but the core app itself remains closed, a middle ground between Exodus (fully closed) and MetaMask (fully open).
Genuinely the broadest coverage we've found in this series: over 100 blockchains and reportedly 10 million-plus tokens, with infrastructure described as capable of supporting 130-plus networks natively.
No explicit fee on staking, buying, sending, or receiving. Swaps carry a real cost, but it's embedded in the quoted exchange rate rather than shown as a separate, explicit percentage.
Multiple sources, including Trust Wallet's own effective positioning, recommend it for active management and daily transactions rather than long-term cold storage, especially given the browser extension's real incident history.
More Reviews
Exodus – Hot Wallet Review
Score: 70/100. Polished, beginner-friendly self-custody, but closed-source code and an optional cloud backup for your seed phrase are real trade-offs.
Read More
MetaMask – Hot Wallet Review
Score: 74/100. The DeFi default for real reasons: open code, broad EVM reach, but no auto-sync and a real fight over non-EVM support.
Read More
Zengo – Hot Wallet Review
Score: 71/100. No seed phrase at all via MPC, but that just relocates trust to Zengo's own servers instead of removing it.
Read More
Phantom – Hot Wallet Review
Score: 68/100. The best-designed wallet here, running closed code with a real, unresolved 2025 lawsuit over a browser-memory key flaw.
Read More