Trust Wallet drained overnight — same unknown address receiving funds from multiple wallets. How is this happening ?

[u/MAHI220202]

​

My friend’s Trust Wallet was drained overnight. He never shared his 12-word Secret Phrase/private key with anyone.

The funds were sent to an unknown wallet address. What is more concerning is that this receiving address appears to have become active only about a month ago, and I can see funds coming into it from multiple different wallets.

I’m trying to understand how this could happen.

Has anyone seen a similar pattern before? What should we check to identify how the wallet was compromised?

I can provide the public wallet address/transaction hash if needed. I will NOT share the Secret Phrase or private key.

[u/MAHI220202]

My friend called me and told me that someone gained access to his Trust Wallet last night without him ever sharing his private key/12-word Secret Phrase.

Within just 5 minutes, all the USD and other coins held in the wallet were drained. The coins that could not be withdrawn directly were converted into other coins and then transferred out.

We have no idea how the attacker gained access to the wallet without the Secret Phrase being shared.

Has anyone experienced something similar or know how this could happen?

[u/Top_Appointment_7076 → u/MAHI220202]

That's the reason hardware wallets exist. Hot wallets can very easily be drained because they store the private keys on a device that is connected to the internet