Update July 27, 2023
Dear Trust Wallet users,
We’d like to share a final update on the claims process for the Trust Wallet Browser Extension issue related to the November 2022 WASM vulnerability, which came to a close on June 30, 2023.
Prior to opening up our claims process, our proactive communication to users resulted in over 90% of affected funds being moved to new addresses which mitigated further losses. Trust Wallet also worked with impacted users to return additional funds throughout the sixty-day claims period.
Choosing to compensate users set a precedent for a free, self-custodial wallet like Trust Wallet which came with a number of challenges unique to the DeFi space. That said, we want to express our deep appreciation for the unwavering support of our dedicated user base and the entire community. A special thank you goes out to the Binance Security and Ledger Donjon teams for their invaluable contributions during this process.
To learn more about the WASM issue and our subsequent response, please view our initial announcement below and postmortem: Browser Extension WASM Vulnerability Postmortem
=====
Posted April 22, 2023
Dear Trust Wallet Community,
Security is the foundation of what we do at Trust Wallet. We are committed to providing secure wallet software and actively collaborate with industry experts to identify, mitigate, and resolve any vulnerabilities quickly. Although we diligently work to prevent vulnerabilities, they may occasionally arise.
In November 2022, a security researcher reported a WebAssembly (WASM) vulnerability in our open-source library, Wallet Core, through our bug bounty program. Our Trust Wallet Browser Extension uses WASM in Wallet Core, and new wallet addresses generated between November 14 and 23, 2022 by Browser Extension contain this vulnerability. We quickly patched the vulnerability, and all addresses created after those dates are safe.
Despite our best efforts, we proactively detected two potential exploits, resulting in a total loss of approximately $170,000 USD at the time of the attack. As a commitment to transparency and user protection, we want to assure users that we will reimburse eligible losses from hacks due to the vulnerability and have created a reimbursement process for the affected users. And we urged affected users move the remaining ~$88,000 USD balance on all the vulnerable addresses as soon as possible.
Recommended Actions for Users
The latest versions of Trust Wallet mobile app and Browser Extension remain safe and secure to use.
WHO IS NOT AFFECTED?
Your wallet addresses are not affected by this vulnerability in the following scenarios:
- If you only use Trust Wallet mobile apps.
- If you only imported wallet addresses into Browser Extension.
- If you only used the Browser Extension to create a new wallet before November 14, 2022 or after November 23, 2022.
WHO IS AFFECTED?
If your wallet addresses are vulnerable, you will see a notification in the Browser Extension. Please open your TW Browser Extension and see whether you received such warning notification.
WHAT ACTIONS TO TAKE?
- If you don’t see the warning notification, your wallet addresses are safe to use, and this vulnerability does not affect you.
- If you received a push notification in your Trust Wallet App or Browser Extension, your private key is affected by a previous exploit and is not safe to use. Move your funds to a newly created wallet in Trust Wallet to avoid risk of fund loss. Please follow this guide.
For users who saw abnormal fund movement late December 2022 and late March 2023, you may be one of the few victims suffering from the two exploits. Please carefully read the reimbursement process to understand the next steps. This is our best effort to verify ownership of the affected addresses and we will reimburse funds to each victim. We have an exact list of all affected wallets.
Recommended Actions for wallet developers using Wallet Core
If you utilized Wallet Core library for developing Browser Extension wallets in 2022, ensure you have implemented the latest version of Wallet Core to prevent your Browser Extension app from being affected by this vulnerability, which may result in losses for your users. We swiftly notified wallet developers known to use Wallet Core for Browser Extension wallets upon discovering the vulnerability.
The postmortem (link) details the incident, what we did, and what we learned for improving and mitigating security handling, and future steps. We apologize for the loss and inconvenience caused to users and assume responsibility for our mistakes while working towards rectifying the situation for affected users. As valid claims come in, we will process as quickly as possible and periodically provide updates. To maintain transparency in the reimbursement process, we will provide regular updates here below.
Victim wallet claims processed: 47 (as of 30 June 2023)
We would like to express our sincere appreciation to the security researcher who discovered and reported the vulnerability to us. His contribution has been invaluable in helping us ensure the security of users’ wallets. We sought guidance from prominent industry professionals to optimize best results for our users. In particular, the Ledger Team and Binance Security team, with their extensive expertise in security best practices, provided invaluable insights throughout the entire process. We would like to express our gratitude for their assistance in addressing this matter. We are honored to be a part of this community.
Sincerely,
The Trust Wallet team
———————————
Frequently Asked Questions (FAQ)
Is it safe to use the Browser Extension?
- Yes. Both the Browser Extension and the mobile app are safe to use. We also recently published a security audits of Browser Extension performed by Certik and Cure53. View the details here.
Is this vulnerability related to the massive wallet drain mentioned in this Twitter post https://twitter.com/tayvano_/status/1648187031468781568?
- No. They are two completely unrelated events. None of the wallet addresses affected by this vulnerability are found in this massive wallet drain mentioned in the Twitter post.
Are any wallets still affected?
- Yes, the vulnerable wallet addresses are vulnerable regardless of the wallet applications or hardware used. The Trust Wallet app and Browser Extension remain safe and secure to use. Affected owners should create a new wallet and transfer funds this newly created wallet (not wallet addresses provided by anyone else) and stop using the tainted addresses.
- Any affected users with the vulnerable addresses will see a notification in their Trust Wallet Browser Extension. We will help you to transfer the funds in your affected wallet to a new wallet address, or reimburse any losses caused by hacks according to the reimbursement process.
- If you haven’t received a notification, your wallet was not affected and no further action is needed.
How did you notify and instruct the affected addresses’ users to move the funds to another secure wallet?
- We informed users immediately via push notifications, warnings, and guides on the actions required for affected users to secure their funds. We also provided dedicated customer support and gas fee assistance to cover the costs of users’ transferring funds. Additionally, when we discovered that the upstream funding of the affected wallet addresses came from Binance, based on public on-chain data, we contacted Binance to assist in notifying the users while maintaining their privacy. It’s important to note that we take the protection of our users’ privacy seriously. No personally identifiable information has ever been shared between Binance and Trust Wallet.
I’m seeing the warning message on my Browser Extension meaning that my wallet address is subject to this vulnerability. If I import that wallet address to somewhere else, will the vulnerability be mitigated and my wallet become safe?
- No, because importing/recovering a vulnerable wallet still leaves the wallet vulnerable. Please follow the guide to transfer your assets to a new wallet address. And stop using the affected wallet address.
How long did it take to fix the vulnerability?
- We fixed the vulnerability within 1 day of verifying the bounty report.
What platforms did this vulnerability affect?
- The vulnerability impacted wallets created in the Browser Extension between November 14 and 23, 2022. This vulnerability was specifically related to the WebAssembly (Wasm) implementation in our open source project Wallet Core and did not originate from the Browser Extension itself.
What was the location of the vulnerability?
- The vulnerability occurred in the back-end module WebAssembly (WASM) located in the open source repository Wallet Core, which affected new wallets generated by versions 0.0.172 and 0.0.182 of the Browser Extension.
What are you doing to ensure security in the Trust Wallet ecosystem?
- We are 100% committed to providing a secure wallet for our users’ to safeguard their funds. In the past few months we’ve taken significant additional steps to enhance our security to keep users funds safe, including:
- Increasing our security audits and audit coverage to x5 times more.
- Engaged multiple top-tier, third-party external auditors to assess our security. View the latest reports here.
- Launched security features including a Security Scanner to warn users of risk.
- For more information, please read our postmortem here.
Was this vulnerability exploited?
- Yes. We fixed the vulnerability within a day, however two exploits occurred within a small window of time, resulting in a total loss of $170,000 USD.
Why are you only communicating about this vulnerability now?
- Securing users’ wallets and preventing/reducing any potential losses was our top priority – and an early public disclosure of the vulnerability would have put users’ at risk of an almost immediate hacks and at a larger scope of loss. We focused on patching the vulnerability, and helping users’ to move their funds utilizing various channels to communicate the situation without drawing the attention of potential bad actors. Over the past few months, we have observed consistent momentum of users moving funds away, and we did not want to deprive them of the time and opportunity to take action. Now the majority of the funds in the affected wallet addresses have been moved to a safe location by users, the momentum of fund movement has been slowing down, and the cost of hack operations is economically not reasonable, so we think it’s a good time to do public disclosure at a much lower risk of user fund loss.
Will Trust Wallet reach out to me directly?
- No, Trust Wallet will not reach out to you directly on this matter. You should only follow the official claim process available here, if you see the Browser Extension warning notification.
- NEVER share your secret phrase with anyone, ever. No legitimate member of the Trust Wallet team will ask you for this. This is for your eyes only.
Does this mean Trust Wallet was exploited?
This was an industry impact, anything built using the MT19937 pseudo-random number generator produce vulnerable wallets. It’s not exclusive to Trust Wallet
Is there a Trust Wallet airdrop for impacted users?
Trust Wallet is not hosting any airdrop for impacted users. Impacted users can submit a claim through our claims process for a 1-1 disbursement.