Trust Wallet Security Guide: How to Keep Your Crypto Safe

Trust Wallet has over 100 million downloads and supports hundreds of blockchains, making it one of the most widely used self-custody wallets. It's also one of the most impersonated — scammers specifically target Trust Wallet users because the user base skews toward beginners who may not have strong security habits yet.

The security setup every Trust Wallet user should have

App lock enabled. Go to Trust Wallet Settings → Security → Passcode and enable a PIN or biometric lock. Set the auto-lock timer to 1 minute. Anyone who picks up your unlocked phone can transfer everything instantly if this isn't set.

Phone-level encryption on. Both iPhone and Android encrypt device storage when you have a lock screen set. Make sure your phone has a lock screen PIN — this protects the app's data if your phone is physically stolen.

Seed phrase backed up offline. Write your 12 words on paper and store it somewhere physically secure — a fireproof box, a safe, a location separate from your phone. Do not take a screenshot, do not email it to yourself, do not store it in a notes app or cloud document. Anyone with those 12 words has complete access to your wallet, forever.

Do not use Trust Wallet on a rooted or jailbroken device. Rooted devices bypass security sandboxing and allow other apps to access Trust Wallet's local storage. This includes your encrypted seed phrase.

Scams that specifically target Trust Wallet users

Fake "Trust Wallet Support" accounts. Twitter, Telegram, and Discord are full of accounts impersonating Trust Wallet support. They reply to users who publicly post about wallet issues, offering help. The help involves visiting a "wallet verification" site or providing your recovery phrase. Trust Wallet support does not DM users proactively. Ever.

Fake Trust Wallet browser extensions. Trust Wallet is a mobile application — it does not have an official browser extension. Any extension in the Chrome or Firefox store claiming to be Trust Wallet is fake and likely a seed phrase stealer. MetaMask, Rabby, and Coinbase Wallet have legitimate browser extensions. Trust Wallet does not.

"Wallet sync" and "wallet verification" phishing sites. Fake sites claim to offer Trust Wallet synchronization, recovery, or verification. They present a form asking for your 12-word recovery phrase to "sync" your wallet. Entering your phrase on any website gives that website full control of your wallet. There is no legitimate reason to enter your phrase online.

Token approvals you may not realize you signed

Trust Wallet is heavily used on BNB Smart Chain (BSC), which has a significantly higher density of scam tokens and malicious DApps than Ethereum mainnet. If you've been active in BSC DeFi, you may have approved contracts you no longer use — and some of those approvals may have been granted to suspicious addresses.

Go to revoke.cash, connect your wallet, and switch to the BNB Smart Chain tab. Review every active approval and revoke anything from a contract you don't recognize or haven't used in months. Each revocation costs a small amount of BNB in gas.

For a full walkthrough, see our guide on revoking token approvals.

What to do if you think your Trust Wallet is compromised

Speed matters. If you suspect your seed phrase was exposed or your wallet was drained by a malicious approval, do this immediately:

1. 1.Create a brand-new wallet on a different device — one that hasn't been exposed to whatever compromised the first.
2. 2.Transfer all assets from the compromised wallet to the new one as quickly as possible. Do not use the compromised wallet after this point.
3. 3.Stop using the old wallet address entirely — even for receiving. It's permanently compromised.
4. 4.Check what approvals the old address granted at revoke.cash, so you understand what access exists and can warn anyone who interacted with those contracts.

For the full picture on protecting your recovery phrase, read our seed phrase security guide.

Frequently asked questions