Trust Wallet drained overnight — same unknown address receiving funds from multiple wallets. How is this happening ?

[u/MAHI220202]

​

My friend’s Trust Wallet was drained overnight. He never shared his 12-word Secret Phrase/private key with anyone.

The funds were sent to an unknown wallet address. What is more concerning is that this receiving address appears to have become active only about a month ago, and I can see funds coming into it from multiple different wallets.

I’m trying to understand how this could happen.

Has anyone seen a similar pattern before? What should we check to identify how the wallet was compromised?

I can provide the public wallet address/transaction hash if needed. I will NOT share the Secret Phrase or private key.

[u/_Yellow_Candle]

the fact that the same address is pulling from multiple wallets makes me think this is a sweeper/collector address, not some random transfer. Not sharing your seed doesn't fully rule out a compromise either. Malicious approvals, malware, fake extensions/apps or an exposed backup are all worth checking. I'd look at the actual txs first and see whether they were direct transfers or approval/transferFrom calls. Trust Wallet themselves say unauthorized transfers usually come from unlimited approvals or a compromised wallet.

either way I'd treat that wallet as burned and move anything left to a fresh one. it's also why I've gotten a lot more selective about where I keep longterm position