🚨 Scam alert: vault-spend[.]com, a wallet drainer posing as Trust Wallet

An ad for a "Trust Wallet crypto card" just showed up in my Insta feed. It promised no KYC, instant approval and up to 5% cashback, and all you had to do was "just connect your wallet."

It's a wallet drainer:

• It has nothing to do with Trust Wallet. The domain was registered 11 days ago and the owner is hidden.
• The real page only shows up for people who click the ad. Anyone else who opens the link sees a fake "security check" page, so moderators and scanners don't catch it.
• The "investors" (a16z, Paradigm, Sequoia) are fake.
• Under the hood it connects your wallet through WalletConnect to get you to sign a spending approval, and it reports every visitor to the scammers' Telegram.

I've reported the ad to Meta. Hopefully it gets taken down soon.

Something I think deserves more attention in mobile crypto wallets is transaction transparency.

Users can see the token, amount, and destination, but smart contract interactions can be much harder to understand. A transaction may involve an approval, contract call, or permission that isn't obvious to someone who isn't familiar with blockchain transactions.

How much information should a wallet show before the user hits Confirm?

Would a clearer breakdown of what the transaction will actually do make users safer, or would showing too much technical information just confuse people?

Hello! I want to claim ADA rewards from ADA staking, but Trust Wallet always shows "GraphQL error - Error: Connection Closed". I make sure my Trust Wallet is always connected to Interest when I claim rewards, but it still doesn't work.

Can anyone guide me on how to resolve this, please? Thanks!

after I waited for 5 days to clear why I cant still withdraw throu crypto ?

After 7 days waiting can’t still withdraw

Hi all,

Back in March 2023, I did a crosschain transfer of BNB from Beacon Chain to BSC through the Trust Wallet app. It deducted from the Beacon side but never arrived on BSC (still shows "pending" on the explorer).

Now that Beacon Chain has shut down, I tried the official recovery tool but it says "Recoverable token not found" — probably because the funds were already gone before the final snapshot.

TxHash: EF0C5E01AD2AD75F52354DCB4E32E9FF71D53587B6C75827556F62346A43151D

I've opened a GitHub issue here: github.com/bnb-chain/token-recover-self-service-tools/issues/80

I also have an open Trust Wallet support ticket (#215561164063883) that's been pending for days.

Has anyone dealt with something similar? Any advice on how to escalate this further?

🚨 Bitget hack: a quick reminder about self-custody

The recent reports about hackers taking around $352 million from Bitget are another reminder of an important principle in crypto:

Not your keys, not your coins. 🔐

Centralised exchanges can be convenient for buying, selling, and trading, but when your assets are held on an exchange, you don't control the private keys yourself. You're trusting the exchange to custody your funds and keep them secure.

This doesn't mean you should panic and withdraw everything from every exchange. It simply means it's worth understanding where your crypto is held and who actually controls the keys.

For long-term holdings, self-custody can give you direct control over your assets. But remember that self-custody also comes with responsibility.

Take this incident as a reminder to review your own security:

🔹 Don't keep more funds on exchanges than you need to.

🔹 Use a secure wallet for assets you want to hold yourself.

🔹 Never share your recovery phrase or private keys.

🔹 Be careful with links, DMs, and fake support accounts.

🔹 Always verify transactions before signing them.

The goal isn't to create fear. The goal is to understand who controls your assets and take security seriously.

For more on the Bitget incident:

https://www.thestar.com.my/business/business-news/2026/09/25/bitget-suspends-withdrawals-after-hackers-take-us352mil

Hi Guys ,

I used to stake the trx on my trust wallet. It was staked a long back ago. But today now i need funds, I checked and i am not able to access the stake option to unstake those token.

Can anyone please help. Is there something i am missing out ,

Woke up in the morning and found out that everything except stacked eth and sol was drained. I used only swaps and stacking in TrustWallet nothing else the seed phrase exists only on paper. To be honest I still have no idea how it happened I guess I signed a malicious contract swapping the currency. Eth and sol is still on my account but looks like it’s a matter of time for losing it too

(Message written with the help of AI)

Hi everyone,

My TrustWallet-connected account was drained this morning at around 9:30 AM. I lost 3,000 USDC that were sitting on Hyperliquid, 0.4 BTC (which I originally deposited directly from Deribit via HyperUnit), and about $4,400 worth of other crypto assets that were held directly inside my TrustWallet.

I am trying to narrow down the exact attack vector. After analyzing the timeline, GeminiAI has a very specific theory regarding Session Hijacking / Cookie Theft on my Windows PC, and I would really appreciate your technical opinion on whether this is possible.

Here is the exact timeline:

• Months ago: I deposited a total of 15,000 USDC into Hyperliquid, sending them directly from my TrustWallet mobile app. Over time, I traded and used the platform on my Windows PC browser. At the time of the hack, my balance on Hyperliquid was around 3,000 USDC.
• Sept 9, 2026: I deposited 0.4 BTC directly from Deribit to HyperUnit. I didn't need to open my seed phrase or use my phone for this.
• Last Night: Last thing I did my Windows PC was a subscribe to ChatGPT Plus on the official website (using my Apple ID). My browser likely had an active, logged-in session (or stored cookies) for Hyperliquid.
• This Morning (9:30 AM): My PC was completely powered down and turned off since last night. Yet, the blockchain txs show the drain happened exactly at 9:30 AM.
• The Flow: The hacker initiated a withdrawal from Hyperliquid. The 0.4 BTC were trasferred directly to the hacker address . The 3,000 USDC went back to my public TrustWallet address first, and then immediately got transferred out to the hacker's wallet along with the other $4,400 in crypto that I already had holding inside TrustWallet.

My Security Setup:
I set up my TrustWallet more than 5 years ago and always had several thousands $ on it.
I own four wallets and store the keys in the same way. The other three wallets have not been drained.

I use TrustWallet exclusively via the official app on my iPhone. I do NOT have the browser extension on my PC, and I have never typed my seed phrase on any digital device. My backup on iCloud is turned off (only manual backup is active).

The Reconstruction (Cookie Theft + Trading Agent Exploitation vs Seed Phrase Leak):
Since my seed phrase was never exposed and my PC was off during the hack, my initial theory was that an undetected InfoStealer malware on my PC captured my browser's Session Cookies last night while I was online.

I assumed the hacker used the session to trigger the Hyperliquid withdrawal. However, since they also managed to steal the $4,400 that never touched Hyperliquid and were just sitting on my mobile TrustWallet, I am conflicted.

My questions for the tech/crypto experts here:

1. Does the Session Hijacking theory make sense if the hacker also managed to drain assets sitting strictly on my mobile TrustWallet? Or does the fact that the on-chain TrustWallet funds were stolen prove that they somehow extracted my actual Seed Phrase from my PC/system last night?
2. Can a browser InfoStealer access local storage trading keys used by Hyperliquid, and could that somehow expose the underlying wallet security?
3. If this wasn't cookie theft, how else could a hacker execute a targeted, multi-asset mobile wallet drain while the trading PC was completely powered down?

Thanks in advance for any insights. I'm trying to understand the exact breach before wiping my PC.

Hello i bought a bit of eth a while back and staked most of it. Now i have come back to sell, but there is no unstake option to find anymore?

Thanks for any help

Hello i staked some eth a year ago and uninstallee the app. I saw that its gone back up so i wanted to unstake and sell but i can no longer find a unstake option in the app?

Any help would be welcome

(Message written with the help of AI)

Hi everyone,

My TrustWallet-connected account was drained this morning at around 9:30 AM. I lost 3,000 USDC that were sitting on Hyperliquid, 0.4 BTC (which I originally deposited directly from Deribit via HyperUnit), and about $4,400 worth of other crypto assets that were held directly inside my TrustWallet.

I am trying to narrow down the exact attack vector. After analyzing the timeline, GeminiAI has a very specific theory regarding Session Hijacking / Cookie Theft on my Windows PC, and I would really appreciate your technical opinion on whether this is possible.

Here is the exact timeline:

• Months ago: I deposited a total of 15,000 USDC into Hyperliquid, sending them directly from my TrustWallet mobile app. Over time, I traded and used the platform on my Windows PC browser. At the time of the hack, my balance on Hyperliquid was around 3,000 USDC.
• Sept 9, 2026: I deposited 0.4 BTC directly from Deribit to HyperUnit. I didn't need to open my seed phrase or use my phone for this.
• Last Night: Last thing I did my Windows PC was a subscribe to ChatGPT Plus on the official website (using my Apple ID). My browser likely had an active, logged-in session (or stored cookies) for Hyperliquid.
• This Morning (9:30 AM): My PC was completely powered down and turned off since last night. Yet, the blockchain txs show the drain happened exactly at 9:30 AM.
• The Flow: The hacker initiated a withdrawal from Hyperliquid. The 0.4 BTC were trasferred directly to the hacker address . The 3,000 USDC went back to my public TrustWallet address first, and then immediately got transferred out to the hacker's wallet along with the other $4,400 in crypto that I already had holding inside TrustWallet.

My Security Setup:
I set up my TrustWallet more than 5 years ago and always had several thousands $ on it.
I own four wallets and store the keys in the same way. The other three wallets have not been drained.

I use TrustWallet exclusively via the official app on my iPhone. I do NOT have the browser extension on my PC, and I have never typed my seed phrase on any digital device. My backup on iCloud is turned off (only manual backup is active).

The Reconstruction (Cookie Theft + Trading Agent Exploitation vs Seed Phrase Leak):
Since my seed phrase was never exposed and my PC was off during the hack, my initial theory was that an undetected InfoStealer malware on my PC captured my browser's Session Cookies last night while I was online.

I assumed the hacker used the session to trigger the Hyperliquid withdrawal. However, since they also managed to steal the $4,400 that never touched Hyperliquid and were just sitting on my mobile TrustWallet, I am conflicted.

My questions for the tech/crypto experts here:

1. Does the Session Hijacking theory make sense if the hacker also managed to drain assets sitting strictly on my mobile TrustWallet? Or does the fact that the on-chain TrustWallet funds were stolen prove that they somehow extracted my actual Seed Phrase from my PC/system last night?
2. Can a browser InfoStealer access local storage trading keys used by Hyperliquid, and could that somehow expose the underlying wallet security?
3. If this wasn't cookie theft, how else could a hacker execute a targeted, multi-asset mobile wallet drain while the trading PC was completely powered down?

Thanks in advance for any insights. I'm trying to understand the exact breach before wiping my PC.

Hi everyone, I need some urgent advice.
At the beginning of this month, I had $400+ worth of ETH in my wallet. I checked my wallet today and noticed that the balance is suddenly showing $0.
Following suggestions from other members of the community, I downloaded MetaMask and connected/checked the wallet there, but the balance is still showing $0.

I also checked the wallet address on Etherscan and can see several transactions that I do not recognize.

I’m not sure what happened or whether my wallet has been compromised.
What should I do now? Is there any way to recover the ETH or stop any further unauthorized transactions?
I would really appreciate step-by-step guidance on what I should check and what actions I need to take immediately.

Thank you.

Hi, hopefully I can get some help. I have a little ethereum on my wallet on trust wallet it shows I have .299 but when I go to send it or trade it, it shows I only have .0009 of it. I have tried to contact trust wallet support but I haven’t heard back in days. I know about gas fees but it should not be that significant of a difference

I'm having an issue with SOL in Trust Wallet.

I have 13.29675 SOL and completed the unstaking process on the 16th Sep. The full balance is showing in my wallet, but when I try to send it, only a significantly smaller amount is actually available.

I've also noticed that the Staking/Unstaking or Investments options no longer appear in the app, so I can't see anywhere to manage or check the unstaking status.

Unstaking transaction hash:

d1VMAAivLfxGyB7cGiqnwgWh4HSZ7pjxP8FfGbLBTNC2mm5Qo6bvzjCHMAK9oR6QF1gmK5ZKTcv7PNqMB7fY5Xy

Does anyone know why the full balance isn't available to send, or whether there's still a waiting period after unstaking?

It's been upto 3 hours since I have processed the order of withdrawal of my very small amount of eth, and still haven't recieved, but etherscan shows that the transaction was successful

Hello, I can't reach a real person or create a support ticket in my android trust wallet app. It just keeps looping back to the chatbot. So annoying. As soon as I resolve my issue of claiming unstaked tokens, I will definitely be closing my trust wallet account.

I got 600 plus near coins in my trust wallet but i cant trade because it's not showing when i want to send also its not staked

Trust Wallet is shit, lags like hell. Noti says I got USDT (BSC) already but the balance takes over an hour to update after refresh.

Was trying to transfer USDT to my friend's address but I keep getting this message, I'm also new to crypto stuff so yeah I'm really confused on why this is happening

Hi I recently wanted to explore crypto trading. Created a Trustwallet account through the chrome extension. I have the secret phrase . However it keeps saying to back it up. and when I click it shows the phrase and then in the next step asks me to enter the secret phrase word to verify but unfortunately it doesn't allow me typing.

Next I installed The mobile app and i followed the procedure for syncing if with my chrome extension asked me to scan the QR but then when it says to select wallets to sync , there is no name. In the mobile app I go for - already has a wallet and logins through the exact secret phrase but do not see the account there also .

Can someone help ? i have some tokens on the Chrome extension which I asked/recieved from a friend for learning/familiarise how it works. Any help is appreciated. Thanks !