Browser-extension WASM vulnerability thread
trustwallet-wasm-update
Latest reviewed change
source content difference between and
The reply from de_javu26 was removed; the depth record shows the current capture scrolled deeper (12 rounds vs 8) but observed one fewer reply (40 vs 41), so the disappearance is not under-collection.
body:
So 20min ago I was able to access someone else's wallet. I surest contacting me
-post: 1650052252176973826
-role: reply
-author: de_javu26
-name: Emmy
-created: 2023-04-23T08:21:28Z
First lines only. The complete diff is in the timeline below.
- Author
- @TrustWallet
- Organisation
- Trust Wallet
- Evidence role
- historical-precedent
- Posted
- 22 Apr 2023, 08:59 UTC
- Capture status
- capture held
Trust Wallet's primary incident thread states the affected browser-extension creation window, that the issue was fixed, and that affected users should follow its remediation guidance. The held capture covered the first post of the ten-post thread until 7 Aug 2026, when the conversation was added to the curated thread tier.
This post is registered as evidence and has a locally held capture. The original remains the canonical publication. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
The conversation
Captured . 9 continuation posts, 39 replies held, 27 muted as low signal. Posts are in the archive's own order, oldest first, not the order X ranks them in.
-
capture taken
1/10 Trust Wallet is built on security & trust. So we're sharing a vulnerability affecting new addresses created Nov 14-23,22 using the Browser Extension. The issue is fixed. Most at-risk funds are secured. Affected users should take actions outlined: http:// trustwallet.com/wasm-disclosure
-
capture taken
2/10 You’re NOT affected if: - You only use the Trust Wallet mobile app - You only imported wallet addresses created somewhere else into Browser Extension - You only used the Browser Extension to create a new wallet before November 14 2022 or after November 23, 2022
-
capture taken
3/10 You are affected if receive a warning notification about this vulnerability in the Browser Extension and created the wallet address in Extension between Nov 14-23, 2022. If that’s the case, then please keep reading for important instructions.
-
capture taken
4/10 The majority of funds at risk have been secured by users. ~$88k total balance left on affected addresses. We urge affected users to move their funds ASAP. AVOID using addresses provided by others. http:// trustwallet.com/migrate-wallet
-
capture taken
5/10 For transparency: we delayed this disclosure to prevent immediate attacks and reduce potential breaches, thus safeguarding assets.
-
capture taken
6/10 For the past months we aggressively pushed 1-1 notifications to affected addresses, resulting in significant fund transfers to secure addresses in strong momentum until recently.
-
capture taken
7/10 Despite our best efforts to minimize loss, we proactively identified 2 likely exploits with a total loss of $170K. To do right to users, we created a reimbursement process for affected users to make them whole. See the claim process here: https:// trustwallet.com/claims
-
capture taken
8/10 We apologize for any inconvenience & are working to rectify this for affected users. Sincere thanks to White-hat community for invaluable contributions via bug bounty. We welcome more submissions & appreciate your support in keeping our ecosystem secure!
-
capture taken
9/10 To clarify: this vulnerability is NOT related to the 5000 ETH wallet drain incident highlighted here https:// x.com/tayvano_/statu s/1648187031468781568 …. None of the affected addresses match the publicized victim list of 5000+ ETH incident.
-
capture taken
10/10 Security is our top priority. While there's no 100% security, we own our mistakes and improve to prevent, mitigate, and resolve issues swiftly. We're committed to providing a secure, reliable platform for our users. Thank you for your understanding and support!
Replies held in this capture (39)
Low-signal replies are collapsed to one line, never removed. A reply is collapsed only on mechanical grounds: fewer than 40 characters, no text, mentions only, no letters or digits, a bare link, or text identical to another reply in the same capture. What a reply argues is never a reason. Each one says which rule collapsed it, and its screenshot is one click away.
-
capture taken
show the capture
capture taken
-
capture taken
.
show the capture
capture taken
-
capture taken
show the capture
capture taken
-
capture taken
Funds are sifu
show the capture
capture taken
-
capture taken
@MultiversX
show the capture
capture taken
-
capture taken
$VRA
show the capture
capture taken
-
capture taken
its centralisation rather than decentralisation
show the capture
capture taken
-
capture taken
Okey, But Why did @TrustWallet Use $EGLD & $CAKE Logo in Image (Airdrop) ??
show the capture
capture taken
-
capture taken
Great wen follow me?
show the capture
capture taken
-
capture taken
Y
show the capture
capture taken
-
capture taken
@YaSerge8 @BoDjimou lisez le fil en dessous
show the capture
capture taken
-
capture taken
@_EverGrowSteve
show the capture
capture taken
The remaining 27 replies
-
我就是这个时间创建的我该怎么弄？
show the capture
capture taken
-
I do trust @TrustWallet
show the capture
capture taken
-
@Tropygalj trustwallet is the best & secured
show the capture
capture taken
-
@guiz
show the capture
capture taken
-
show the capture
capture taken
-
Why Egld ?? @MultiversX
show the capture
capture taken
-
Yes
show the capture
capture taken
-
Integrate @losslessdefi @TrustWallet
show the capture
capture taken
-
#Buy_Firu in @ubeswap
show the capture
capture taken
-
Stay away they will take all your crypto and you will never get them back!! Warn everyone!! This site is a scam!!
show the capture
capture taken
-
Scammers!!!!
show the capture
capture taken
-
Bitcoin Cash (BCH) node is fixed?
show the capture
capture taken
-
One of my best wallets
show the capture
capture taken
-
show the capture
capture taken
-
.
show the capture
capture taken
-
Good afternoon.. I had a problem with my wallet, it was hacked and my ethereun lost.
show the capture
capture taken
-
Lol and the say its safe. Once again people use a cold storage dont use extensies wallet bullshit
show the capture
capture taken
-
My $34 was withdrawn in match and I complaint to u people and nothing has been done about it till today kindly sent my money back to my wallet
show the capture
capture taken
-
My deposit issues not solve
show the capture
capture taken
-
"reimburse eligible losses from hacks due to the vulnerability" Meaning, they won't reimburse all losses from this vulnerability or any other vulnerabilities.
show the capture
capture taken
-
Who do I need to talk to as my account has been hacked and this person keeps going into my account and stealing all of my coins and today has moved to my nfts
show the capture
capture taken
-
You owe me alot of money trust wallet
show the capture
capture taken
-
Esa vulnerabilidad, se reportó hace más de 5 meses, de wallet comprometidas.. y hasta ahora solo la corrigen?
show the capture
capture taken
-
thieves
show the capture
capture taken
-
Hey @EowynChen and @TrustWallet ! On May 21, $7,000 USDT was stolen from my wallet, it was created on November 10, 2022 and I think it falls under this vulnerability. I filled out a form on the your website the same day, but I still haven't received a response
show the capture
capture taken
-
what a garbage wallet lol
show the capture
capture taken
-
any solution to unblocked my usdt?
show the capture
capture taken
This capture reached the end of the conversation as X served it: it stopped because nothing further loaded, not because a limit was hit. X decides what a reader is shown, so that is not the same as a guarantee of every reply.
Held captures
-
The reply from de_javu26 was removed; the depth record shows the current capture scrolled deeper (12 rounds vs 8) but observed one fewer reply (40 vs 41), so the disappearance is not under-collection.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 9 lines
body: So 20min ago I was able to access someone else's wallet. I surest contacting me -post: 1650052252176973826 -role: reply -author: de_javu26 -name: Emmy -created: 2023-04-23T08:21:28Z -media: 0 -body: -Please who can help me with 1 eth let me start up something - post: 1650087649695211520 role: reply author: tuntun8568Extracted text as captured
thread: 1649699428733947906 url: https://x.com/TrustWallet/status/1649699428733947906 author: TrustWallet post: 1649699428733947906 role: focal author: TrustWallet name: Trust Wallet created: 2023-04-22T08:59:28Z media: 0 body: 1/10 Trust Wallet is built on security & trust. So we're sharing a vulnerability affecting new addresses created Nov 14-23,22 using the Browser Extension. The issue is fixed. Most at-risk funds are secured. Affected users should take actions outlined: http:// trustwallet.com/wasm-disclosure post: 1649699431992942595 role: self-thread author: TrustWallet name: Trust Wallet created: 2023-04-22T08:59:29Z media: 0 body: 2/10 You’re NOT affected if: - You only use the Trust Wallet mobile app - You only imported wallet addresses created somewhere else into Browser Extension - You only used the Browser Extension to create a new wallet before November 14 2022 or after November 23, 2022 post: 1649699438028546048 role: self-thread author: TrustWallet name: Trust Wallet created: 2023-04-22T08:59:30Z media: 0 body: 3/10 You are affected if receive a warning notification about this vulnerability in the Browser Extension and created the wallet address in Extension between Nov 14-23, 2022.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
thread: 1649699428733947906 url: https://x.com/TrustWallet/status/1649699428733947906 author: TrustWallet post: 1649699428733947906 role: focal author: TrustWallet name: Trust Wallet created: 2023-04-22T08:59:28Z media: 0 body: 1/10 Trust Wallet is built on security & trust. So we're sharing a vulnerability affecting new addresses created Nov 14-23,22 using the Browser Extension. The issue is fixed. Most at-risk funds are secured. Affected users should take actions outlined: http:// trustwallet.com/wasm-disclosure post: 1649699431992942595 role: self-thread author: TrustWallet name: Trust Wallet created: 2023-04-22T08:59:29Z media: 0 body: 2/10 You’re NOT affected if: - You only use the Trust Wallet mobile app - You only imported wallet addresses created somewhere else into Browser Extension - You only used the Browser Extension to create a new wallet before November 14 2022 or after November 23, 2022 post: 1649699438028546048 role: self-thread author: TrustWallet name: Trust Wallet created: 2023-04-22T08:59:30Z media: 0 body: 3/10 You are affected if receive a warning notification about this vulnerability in the Browser Extension and created the wallet address in Extension between Nov 14-23, 2022.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
3 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
- +0 -50 Four old reply records from 2023 left the captured thread; the newer capture scrolled deeper (14 rounds versus 10) but observed fewer replies (39 versus 43), indicating ranking/selection churn rather than deletion.
- +50 -0 Four old 2023 replies re-entered the ranked view even though the later capture used fewer scroll rounds (10 versus 14) and observed more posts (53 versus 49), so the change is ranking recovery rather than new content.
- +0 -9 A 2023 reply dropped from a deeper capture that still observed fewer total replies, so the absence is ranking or hydration variance, not a deletion.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.